topic Re: search a query on splunk using the rest api in Getting Data In

search a query on splunk using the rest api

vagdevi — Tue, 09 Feb 2021 13:55:53 GMT

Hi,

I want to create a rest api request to create a search in splunk and get the details(logs) of the search result. I have gone through the splunk document provided by the splunk team, but couldn't get the response properly. I am trying all the ways to hit splunk and search, but it isn't work. I am using basic auth for the request in postman .Please help me to get through this. I am attaching the splunk we are using and the search query we have to use and also the postman request to hit the same

I want to use only postman for the search, not a curl command.

Re: search a query on splunk using the rest api

awslabspl — Tue, 09 Feb 2021 15:13:20 GMT

Better to use different tool and leave Splunk all alone. Not worth even trying. Awful community. Awful UI/UX, almost imaginary docs..........

Also I wouldnt risk downloading files from them (if you are thinking of self-hosting this ).

Re: search a query on splunk using the rest api

vagdevi — Tue, 09 Feb 2021 15:25:52 GMT

but, we are supposed to use splunk for monitoring the logs, as per client

Re: search a query on splunk using the rest api

scelikok — Tue, 09 Feb 2021 18:30:48 GMT

Hi @vagdevi,

Please try with jobs/export endpoint like below, it will work with basic or bearer token auth.

https://splunk_server:8089/services/search/jobs/export?search=search index=_internal earliest=-1d latest=now | stats count by host&output_mode=json

Re: search a query on splunk using the rest api

vagdevi — Mon, 15 Feb 2021 08:25:11 GMT

Hi @scelikok ,

Thanks for the reply

I tried the query you provide, but couldn't get the output. It says error not found.

Re: search a query on splunk using the rest api

scelikok — Mon, 15 Feb 2021 11:26:49 GMT

Hi @vagdevi,

I am attaching the postman screenshot with a working example. Please check what is different?

Re: search a query on splunk using the rest api

vagdevi — Mon, 15 Feb 2021 14:08:52 GMT

Thanks for the screenshots, but i want to have the logs out from splunk thru postman, not just the count,

Re: search a query on splunk using the rest api

scelikok — Mon, 15 Feb 2021 14:36:08 GMT

I used a sample simple search that is short and can run anywhere. Screenshots are for you to compare with yours since you told your getting "error not found".

The only thing you need to do is change the search parameter value with your search. You should see your results in postman.