All Apps and Add-ons

How can I authenticate to the REST API, pass the query, and close the session (in one fell swoop)?

New Member

How set several request in one input ?

I must first authenticate to the REST API, then pass the query, and at end close the session


0 Karma


Yes, those are three separate steps, but I believe that you can combine them a bit. For example, this curl command should run authenticate and run a search, without creating a session.

curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search *"

This comes from the REST API tutorials:
The difficulty is that this command returns a search job id, not the actual search results. You need to make a second call (shown in the tutorial) to actually retrieve the results.

If you use one the of SDKS (eg. Python or Java), you will see that they provide a "one shot" search as part of the SDK, which does do what you want. But I don't know how to do this with a single call to the REST API.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...