Getting Data In

Accessing Saved Report output in json from Splunk Rest API

twh1
Communicator

I have some reports saved under search app. I want to access these report output via Splunk REST API in a java program. I am trying below rest API for accessing output in java program.

API: https://hostname:8089/services/saved/searches/report_name

I can get all related details of this report but unable to get actual output.

Can anyone help me getting the output of this report in json format.

0 Karma

jkat54
SplunkTrust
SplunkTrust

First you must dispatch the report (if you havent already updated it using other means), then you must get the results endpoint to get the results.

When you dispatch the search, you will get a SID (search id). You use that SID in your quest for the results over here at the search/jobs/$SID$/results endpoint:

https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTsearch

Remember that alerts, reports, and searches are all just searches. So the best examples I know of are here in the rest tutorial for searches:

https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTTUT/RESTsearches

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...