All Apps and Add-ons

REST API usage to get log size at source level? Splunk UI query works well.

srujanredy
New Member

Equivalent Splunk UI query: Working well
source=/abc/log/* earliest="11/19/2018:08:00:00" latest="11/19/2018:18:00:00" | eval raw_len=len(_raw) | eval raw_len_gb = raw_len/1024/1024/1024 | stats sum(raw_len_gb) as GB by source, host | sort - GB

Rest API Usage?

I've tried the below curl command via REST API but didn't get same log sizes as in splunk UI query.

curl -vu user:pass -d output_mode=csv -o /home/someuser/output.csv -k https://organisation.fmr.com/servicesNS/admin/search/search/jobs/export -d search='search earliest="11/19/2018:08:00:00" latest="11/19/2018:18:00:00" group=per_source_thruput series=/abc/log/* | eval raw_len=len(_raw) | eval raw_len_gb = raw_len/1024/1024/1024 | stats sum(raw_len_gb) as GB by series | sort - GB'

Results from Splunk UI are 100-1000% greater than results from the Curl via REST API.

Can someone please help me with the correct REST API usage to get the same results as given by splunk UI query.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...