topic Unable to search using REST API in Splunk Search

Unable to search using REST API

vinitchaudhari1 — Mon, 18 Feb 2019 04:42:55 GMT

Hi I have a cloud instance version 7.0.2.1 https://prd-p-df4vmzb62ds7.cloud.splunk.com. I am trying to use REST API to run search but I am always getting Page Not Found error. I gave correct username/password. I tried running simple POST call using endpoint utr https://prd-p-df4vmzb62ds7.cloud.splunk.com/services/auth/login but it is not working. If anyone has used REST API then can you please help? I also have local version 5.x but it is not enterprise. Is REST API supported only in enterprise version?

Re: Unable to search using REST API

seegeekrun — Tue, 19 Feb 2019 20:28:29 GMT

Are you using port 8089?
https://your-instance.com:8089/services/admin...

The UI runs on port 8000 and is typically forwarded from 443. But the API Endpoints are over 8089, which is also the management port.

Re: Unable to search using REST API

vinitchaudhari1 — Tue, 19 Feb 2019 22:37:06 GMT

Thanks Seegeekrun for the response. I am using 8089. I just found out that it works with curl but not with Postman or SOAP UI. Is there a way to use Postman or SOAP UI for Splunk REST API?

Re: Unable to search using REST API

seegeekrun — Wed, 20 Feb 2019 15:29:03 GMT

In Postman or Soap UI, you'll want to make sure that Authorization (Basic Auth) is set and the credentials are added.

Postman - Authorization
https://learning.getpostman.com/docs/postman/sending_api_requests/authorization/
Soap UI - How to Authenticate
https://www.soapui.org/soap-and-wsdl/authenticating-soap-requests.html