topic Re: Run DBX query via REST API in Splunk Search

Run DBX query via REST API

mxanareckless — Mon, 18 Jan 2021 23:51:02 GMT

I've checked this, but it hasn't solved the problem for me: https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-run-a-curl-command-on-a-dbxquery/m-p/500081#M85221

This is my curl request:

curl -u username:password -k https://192.168.xx.xxx:xxxx/services/search/jobs -d search=" | dbxquery query=\"select (select sum(bytes) from dba_data_files)+(select sum(bytes) from dba_temp_files)-(select sum(bytes) from dba_free_space) total_size from dual\" connection=\"XXX\""

And I get an SID back:

<?xml version="1.0" encoding="UTF-8"?> <response> <sid>1611013146.153172</sid> </response>

However when I try fetching the results, I get nothing back:

[user.name@host ~]$ curl -u username:password -k https://192.168.xx.xxx:xxxx/services/search/jobs/1611013146.153172/results/ --get -d output_mode=csv [user.name@host ~]$

I've tried waiting a few minutes in between fetch attempts, still nothing. This same query works find and returns a result immediately when run from the DBX UI:

Is there something I'm missing here in order to get the result via the REST API? Thanks.

Re: Run DBX query via REST API

scelikok — Tue, 19 Jan 2021 13:56:09 GMT

Hi @mxanareckless,

You can try with export endpoint;

curl -u username:password -k https://192.168.xx.xxx:xxxx/services/search/jobs/export --data-urlencode search=' | dbxquery query=\"select (select sum(bytes) from dba_data_files)+(select sum(bytes) from dba_temp_files)-(select sum(bytes) from dba_free_space) total_size from dual\" connection=\"XXX\"'

If this reply helps you an upvote is appreciated.

Re: Run DBX query via REST API

mxanareckless — Tue, 19 Jan 2021 17:25:15 GMT

@scelikok Thank you; but still nothing is being returned after trying for 10 minutes, until eventually an error "Unknown SID" is returned:

[user.name@host ~]$ curl -u username:password -k https://192.168.xx.xxx:xxxx/services/search/jobs/export --data-urlencode search=' | dbxquery query=\"select (select sum(bytes) from dba_data_files)+(select sum(bytes) from dba_temp_files)-(select sum(bytes) from dba_free_space) total_size from dual\" connection=\"xxx\"' <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder /> </meta> <messages> <msg type="DEBUG">Configuration initialization for /opt/splunk/etc took 19ms when dispatching a search (search ID: 1611076520.164004)</msg> <msg type="DEBUG">The 'dbxquery' command is implemented as an external script and may cause the search to be significantly slower.</msg> <msg type="DEBUG">search context: user="username", app="search", bs-pathname="/opt/splunk/etc"</msg> </messages> </results> # Querying for result for 10 minutes, until below occurs: [user.name@host ~]$ curl -u username:password -k https://192.168.xx.xxx:xxxx/services/search/jobs/1611076520.164004/results/ --get -d output_mode=csv <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="FATAL">Unknown sid.</msg> </messages> </response>