topic Re: Retrieving Search Results via Splunk API in Splunk Search

How retrieve search results via Splunk API?

qcjacobo2577 — Mon, 22 May 2023 13:10:12 GMT

I recently enabled Splunk tokens (using SAML authentication) and am able to successfully execute basic API calls (such as the one below).

curl -H "Authorization: Bearer <token>" -X GET https://<host>.splunkcloud.com:8089/services/authorization/roles

I have a Splunk search that works great from the Splunk Cloud UI, but I would like to be able to retrieve the same data in either JSON or CSV format. I have attempted to follow the Splunk documentation on this, but being brand new may simply be missing something.

What is the best way to achive my goal in this case?
Is using Splunk tokens the preferred/best approach?

Re: Retrieving Search Results via Splunk API

yuanliu — Sat, 20 May 2023 04:59:43 GMT

To perform a search, you first post it to the search endpoint as a job.

curl -H "Authorization: Bearer <token>" https://<host>.splunkcloud.com:8089/services/search/job -d search="my great search"

This will submit "my great search" and return an XML document. You then use the value of the document's <sid /> segment get the result, like this

curl -H "Authorization: Bearer <token>" --get https://<host>.splunkcloud.com:8089/services/search/job/<sid>/result" -d output_mode=json

Of course, you can use output_mode=json in the first command and use the sid node of the JSON document.