topic Re: splunk API from browser in Splunk Search

splunk API from browser

vasanthi77 — Mon, 02 Sep 2019 00:19:56 GMT

Hi all ,

I am using below url to get data from splunk

which is giving output continuously , even though i have mentioned head 1.

below is the actual query which gives one row.

How do i achieve same from browser.

Re: splunk API from browser

jawaharas — Mon, 02 Sep 2019 06:16:56 GMT

The issue is not replicable in Splunk 7.2. Which version of Splunk you are using?

Re: splunk API from browser

vasanthi77 — Mon, 02 Sep 2019 06:38:05 GMT

@jawaharas I m using 7.2.7. I m getting continuous output like this , Is not the same case for you?

 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"51.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"51.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"51.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"51.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"51.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"51.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"100.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"100.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":true,"offset":0,"lastrow":true,"result":{"Value":"100.00","_time":"2019-09-02 14:08:56.000 AEST"}}
 {"preview":false,"offset":0,"lastrow":true,"result":{"Value":"100.00","_time":"2019-09-02 14:08:56.000 AEST"}}

Re: splunk API from browser

drfk — Mon, 02 Sep 2019 12:17:16 GMT

This is expected behaviour as is documented here for the search/jobs/export endpoint:
"Stream search results as they become available."
https://docs.splunk.com/Documentation/Splunk/7.3.1/RESTREF/RESTsearch#search.2Fjobs.2Fexport

To get only a single result (i.e. not streaming), you could send a POST-request to the search/jobs endpoint. However, afaik this is not easily done in a browser.

Re: splunk API from browser

vasanthi77 — Tue, 03 Sep 2019 00:53:43 GMT

@drfk Can i post using browser

Re: splunk API from browser

drfk — Tue, 03 Sep 2019 06:49:28 GMT

There seem to be plugins for browsers that can do that, especially for testing REST APIs. However, you can better search for what you need yourself, as I wouldn't know any more about that.