<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to make rest search on one search head able to get results from other search heads? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583404#M203155</link>
    <description>Yes, but as I said, it's for inputs and probably not working as you need without changes? I haven't use it by myself.</description>
    <pubDate>Wed, 02 Feb 2022 14:28:31 GMT</pubDate>
    <dc:creator>isoutamo</dc:creator>
    <dc:date>2022-02-02T14:28:31Z</dc:date>
    <item>
      <title>How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583259#M203091</link>
      <description>&lt;P&gt;If you have a dashboard that has a panel with a&amp;nbsp; search like the one below:&lt;/P&gt;&lt;P&gt;| rest splunk_server=* /services/-/-/admin/......../appName/local&lt;BR /&gt;| table name splunk_server title&lt;/P&gt;&lt;P&gt;How can you make it so that it searches the other search heads? (a search like the one above returns values for the current search head and its peers - indexers)&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 01 Feb 2022 18:11:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583259#M203091</guid>
      <dc:creator>jaburke1</dc:creator>
      <dc:date>2022-02-01T18:11:15Z</dc:date>
    </item>
    <item>
      <title>Re: How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583264#M203093</link>
      <description>&lt;P&gt;If you want to search from other search head you must define those as a search peers to this node. Usually this is not a thing you want to do as it’s affects also on all normal searches.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;If/when you have a MC (monitoring console) it has defined those SHs as a search peers already and you can run that query there.&lt;/P&gt;&lt;P&gt;r. Ismo&lt;/P&gt;</description>
      <pubDate>Tue, 01 Feb 2022 19:01:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583264#M203093</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2022-02-01T19:01:51Z</dc:date>
    </item>
    <item>
      <title>Re: How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583368#M203139</link>
      <description>&lt;P&gt;Thanks isoutamo.&amp;nbsp; Agree I do not want to make them peers. Do you know if this could be done using a custom command?&lt;/P&gt;</description>
      <pubDate>Wed, 02 Feb 2022 11:19:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583368#M203139</guid>
      <dc:creator>jaburke1</dc:creator>
      <dc:date>2022-02-02T11:19:52Z</dc:date>
    </item>
    <item>
      <title>Re: How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583398#M203153</link>
      <description>&lt;P&gt;If/when you can set authentication&amp;amp;authorization to that command and use it in custom command it should work. I don't see any (real) reason why you couldn't use python and make rest request from it to correct target?&lt;/P&gt;&lt;P&gt;If I recall right in splunkbase there is already some package for doing rest inputs (TA-rest or something)? Probably you could use it as starting point if it didn't work without changes?&lt;/P&gt;&lt;P&gt;r. Ismo&lt;/P&gt;</description>
      <pubDate>Wed, 02 Feb 2022 14:14:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583398#M203153</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2022-02-02T14:14:29Z</dc:date>
    </item>
    <item>
      <title>Re: How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583403#M203154</link>
      <description>&lt;P&gt;isoutamo - Thank you very much!&lt;/P&gt;&lt;P&gt;Is "REST API Modular Input" the app you are referring?&lt;/P&gt;&lt;H3&gt;&amp;nbsp;&lt;/H3&gt;</description>
      <pubDate>Wed, 02 Feb 2022 14:27:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583403#M203154</guid>
      <dc:creator>jaburke1</dc:creator>
      <dc:date>2022-02-02T14:27:03Z</dc:date>
    </item>
    <item>
      <title>Re: How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583404#M203155</link>
      <description>Yes, but as I said, it's for inputs and probably not working as you need without changes? I haven't use it by myself.</description>
      <pubDate>Wed, 02 Feb 2022 14:28:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583404#M203155</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2022-02-02T14:28:31Z</dc:date>
    </item>
    <item>
      <title>Re: How to make rest search on one search head able to get results from other search heads?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583406#M203156</link>
      <description>&lt;P&gt;isoutamo - I understand. Thank you very much!&lt;/P&gt;</description>
      <pubDate>Wed, 02 Feb 2022 14:33:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-make-rest-search-on-one-search-head-able-to-get-results/m-p/583406#M203156</guid>
      <dc:creator>jaburke1</dc:creator>
      <dc:date>2022-02-02T14:33:08Z</dc:date>
    </item>
  </channel>
</rss>

