topic Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned? in Splunk Search

Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

ks2211 — Mon, 04 Jan 2016 16:25:02 GMT

Hi All,

I'm trying to build a mini SDK for the REST API using Golang (focusing on the search/saved search endpoints at the moment). I've got alot of the endpoints working individually where I can create saved search, dispatch, delete, etc. Same with searching where I can search jobs, get search results of a job, etc.

However,
When I try to run multiple methods in succession (mainly Dispatch Saved Search to get SID and then get Search Results for given SID), it fails. The Dispatch method returns the SID.
When I try to run the Search Results GET with the SID though, it returns nothing.

Any one have any suggetsions on this?

Thanks

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

sowings — Mon, 04 Jan 2016 16:38:17 GMT

Can you provide the paths to the endpoints you're querying? I'm not sure which of several possible endpoints you mean by "Search Results GET".

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

ks2211 — Mon, 04 Jan 2016 16:42:13 GMT

So I use this one
"saved/searches/{name}/dispatch" to get the SID

Then I try this one
"search/jobs/{search_id}/results" to get the results of the saved search

The SID returns fine. But I can't get the results back--for whatever reason.
The request URL when the code runs returns the data fine in the browser/curl request. However, it seems like my code isn't going through to hit the endpoint after the first time.

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

sowings — Mon, 04 Jan 2016 16:47:53 GMT

Dispatch runs a search, and then if you're immediately trying to get <sid> results, it might not be done (and there may be no results). You could consider an intermediary step at /search/jobs/<sid> to see the value of isDone....

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

ks2211 — Mon, 04 Jan 2016 17:21:20 GMT

Ahhhhhhh this is perfect thank you! Now it works fine 😄

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

ks2211 — Tue, 05 Jan 2016 19:01:25 GMT

Hey so I just had a question regarding this--is there a good way to check the status of the job and get the SID and then get the results?

Currently, I'm hitting the endpoint /search/jobs/ but I'm doing a set interval (or time.Sleep in Golang's case) to pause the program at this state until the job is "done".

Is there a way to not pause and I guess poll this endpoint (not sure if this is correct terminology?)

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

Ravimrawi — Wed, 20 Apr 2016 15:23:19 GMT

I'm unable to get the sid for my search rather I'm getting the below details. Please assist

curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head

https://splunkapi.homedepot.com:8089/services/search/jobs
2016-04-20T11:22:46-04:00

<name>Splunk</name>

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

Ravimrawi — Wed, 20 Apr 2016 15:23:56 GMT

--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Re: Using REST API search endpoints to retrieve a saved search SID and search results, why are no results returned?

Ravimrawi — Wed, 20 Apr 2016 15:28:43 GMT

COuld you tell me how to get rid all these texts and get only the sid ?