Splunk Dev

Splunk Java SDK: How do you query a macro defined in a custom app instead of the default splunk search app?

dinh
Path Finder

I have a custom app defined. I want to query a macro defined in it. The samples provided here (http://code.google.com/p/splunk-java-sdk/w/list) call splunk's search app by default. How do I get it to call my custom app instead?

Tags (2)
0 Karma
1 Solution

dinh
Path Finder

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

View solution in original post

psanford_splunk
Splunk Employee
Splunk Employee

We are currently building out a new Java SDK. It will be available on GitHub. I can give pre-release access - just need a GitHub ID.

Any questions - psanford@splunk.com or ping us on Twitter: @splunkdev

wcolgate_splunk
Splunk Employee
Splunk Employee

The Java SDK supports namespaces for exactly this reason.

0 Karma

dinh
Path Finder

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

wcolgate_splunk
Splunk Employee
Splunk Employee

While the URLs are correct, the Java SDK (which the OP refers to), supports namespaces. There is a description here: http://dev.splunk.com/view/SP-CAAAECN#namespaces

0 Karma

Johnvey
Contributor

If you are using the SDK from the current source, you can specify an optional namespace parameter when dispatching a job to target a specific app. See the inline docs here:

http://code.google.com/p/splunk-java-sdk/source/browse/trunk/SplunkSDK/src/com/splunk/sdk4x/search/J...

Note that the SDK is not considered stable for 4.0. Read more about Splunk's SDKs and APIs.

dinh
Path Finder

I set the namespace in the my job parameters and I see it go out on the POST, but it is still not working. I get the same error as before which is that it could not find the macro. I'm wondering if the REST api is even looking at the namespace parameter.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...