Hi,
I am trying to use splunk rest api to call the logs to do some dashboarding in our external application.
There will be a java middle ware that will call these api and response will be parsed by the UI. But when i call the splunk rest api it returns multiple json records but not as a list. Just seperate json records , It will be troublesome to parse it as its not a list . How do we make sure the response from splunk rest api is just 1 valid json that can be parsed?
The screen shows the query and response from postman. How do we get a single json response from Splunk that has these json results as a list that can be parsed easily by a program
To specify the response format, use the output mode parameter in your REST API call. When you set it to "JSON," the response is returned as a single JSON object that can be easily parsed. Here's an illustration:
https://<host>:<port>/services/search/jobs/export?output_mode=json&search=<search query>
Replace host> and port> with the values for your Splunk instance, and search query> with your desired search query.
It's already used as part of request parameters.
We are getting output in Json format . Just that we are getting multiple records. One record for each status-code and it's a separate document . Not part of a Json list
In that case, @HemanthShekar, you must modify your Splunk search query to return the results as a single JSON object. Use the stats command to aggregate the results and return them as a single JSON object in your search query.
Here's an example:
GET /services/search/jobs/export?output_mode=json&search=search+index%3D*+earliest%3D-24h%40h+latest%3Dnow+|+stats+values(status_code)+by+status_code&count=1000
This will return the count of each status code value as a single JSON object, which your Java middleware can quickly parse. You can modify the search query to meet your specific needs.