topic Re: How to call Splunk API using Postman? in Splunk Search

How to call Splunk API using Postman?

kranthimutyala2 — Wed, 03 Apr 2024 13:36:02 GMT

curl -k -u svc_aas -d search="search index=aas sourcetype=syslog" https://splunk-prod-api.internal.xxxx.com/services/search/jobs
I want to run this using Postman can someone help me frame the Postman queries to search and retrieve Splunk logs

Re: How to call Splunk API using Postman?

marnall — Fri, 05 Apr 2024 21:34:52 GMT

There are different REST endpoints for Splunk to start or retrieve searches. Some will start a search and return a search ID, others will retrieve results from a previous search job.

Probably the most straightforward is the /jobs/export one, which starts a job and returns results, though this will take time for the started search to complete. An example request for this endpoint would be:

curl -k -u <user_in_splunk> https://<yoursplunkhost>:8089/services/search/v2/jobs/export -d search="<yoursplsearch>"

E.g.

curl -k -u svc_aas -d search="search index=aas sourcetype=syslog" https://splunk-prod-api.internal.xxxx.com:8089/services/search/v2/jobs/export

Note that this curl request will request a password for the splunk user. There may be functionality in postman to supply this password.

Re: How to call Splunk API using Postman?

PickleRick — Sat, 06 Apr 2024 10:23:56 GMT

The main question is whether you don't know how to use API to perform searches in which case you should star with https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTprolog or whether you don't know how to use podman correctly - this is out of scope of this forum but maybe someone with experience with this tool can give a hint or two.