topic Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"? in Splunk Search

Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

a212830 — Mon, 23 May 2016 19:26:38 GMT

Hi,

I have the following rest call on a new 6.4 environment, and it's coming back with error:

curl: (56) Failure when receiving data from the peer

Not sure what's wrong...

curl -k -u  admin:pass -k http://myhost:8089/servicesNS/-/-/search/jobs/export -d search="search index=_internal|head 2 |table sourcetype, eventtype, source, host" -d output_mode=csv

The admin account has all the reset capabilities enabled on it.

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

jkat54 — Mon, 23 May 2016 19:41:39 GMT

You gave it http instead of https and -k twice (which means ignore ssl issues). Providing -k twice isn't required.

 curl -k -u admin https://myhost:8089/servicesNS/-/-/search/jobs/export -d search="search index=_internal|head 2 |table sourcetype, eventtype, source, host" -d output_mode=csv

You don't need the -k if it isn't https OR if the certificate is valid for the connection.

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

supabuck — Mon, 22 Aug 2016 19:20:53 GMT

I had the same issue, and this method worked for me. Thank you jkat!

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

jkat54 — Sun, 07 May 2017 15:33:55 GMT

@a212830, did this answer work for you? If so, can you please mark it as the answer?

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

jkat54 — Wed, 14 Jun 2017 21:12:21 GMT

@a212830 can you come back to this thread please?

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

highsplunker — Wed, 15 Apr 2020 20:59:10 GMT

thanks a lot, helped me!
question: why this search does not work

curl -ku admin
http://myserver:8089/services/search/jobs/export
-d search= "| makeresults | eval amount=1001, score=777 "

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

highsplunker — Wed, 15 Apr 2020 21:01:11 GMT

it works fine! thanks!
could you tell please why this does not work
curl -ku admin http://myserver:8089/services/search/jobs/export -d search= "| makeresults | eval amount=1001, score=777 "
?

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

jkat54 — Wed, 15 Apr 2020 21:21:51 GMT

Because the splunk rest api uses HTTPS protocol.

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

highsplunker — Wed, 15 Apr 2020 21:27:19 GMT

sorry, i meant this
curl -k -u admin https://localhost:8089/services/search/jobs/export -d search= "| makeresults | eval amount=1001, score=777 "
<-- this does not work...

I'm playing with Google's GCP, temporarily installed a "little" Splunk version there. And something is wrong with the access point. It perfectly worked at my job.

Re: Why is my Splunk REST API search not working and getting error "curl: (56) Failure when receiving data from the peer"?

jkat54 — Fri, 24 Apr 2020 13:19:14 GMT

Please create a new question with these details.