topic Re: How to run Splunk searches in a custom REST endpoint? in Splunk Search

How to run Splunk searches in a custom REST endpoint?

i2sheri — Wed, 02 Dec 2015 06:17:07 GMT

I have implemented a custom rest end point and it's working. Now I have another requirement to run Splunk searches in the same rest end point, so I would like to know the best practice for it.

I've tried calling search/jobs rest point, but I do not see actual search results

Re: How to run Splunk searches in a custom REST endpoint?

jplumsdaine22 — Wed, 02 Dec 2015 13:27:48 GMT

When you POST to /services/search/jobs, the response from the splunk server should be a search id (sid). You will then need to do a GET request to /services/search/jobs//results to get the results from splunk (when they are ready)

Alternatively you can use the /services/search/jobs/export endpoint. This will stream the results back to you.

Re: How to run Splunk searches in a custom REST endpoint?

i2sheri — Mon, 21 Dec 2015 05:04:22 GMT

I've already tried singleshot search to services/search/jobs end point with splunk.rest.simpleRequest() but I did not receive results. No luck with /services/search/jobs/export endpoint too.

Re: How to run Splunk searches in a custom REST endpoint?

i2sheri — Mon, 21 Dec 2015 05:04:46 GMT

I've tried singleshot search to services/search/jobs end point with python requests and it works.