Call Splunk API to Get Sid

[manhuang]

I make a call to the Splunk REST API to get sid.
api is /services/search/jobs?output_mode=json
In a general way, it will return an sid like 1464774202.16228 for me to get a final result.
But sometimes, it will return me a lot of info without sid, but dispatchState is Done.
Seems like something does not work.
Why do I get a result like this?

[jkat54 · Accepted solution]

Try adding exec_mode to your post.

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/RESTREF/RESTsearch#search.2Fjobs

[jkat54]

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/search/jobs --data-urlencode search="search index=_internal source=*/metrics.log" -d id=mysearch_02151949

[slw07gdev]

thank you!

[jkat54]

Anytime!!!

[jkat54]

You can also specify the id you want. Do you see in the documentation how to expand the "post" section to see all the parameters?

[slw07gdev]

I'm experiencing the same issue. Trying to create a search, but getting unexpected data back.

When issuing a GET request to the URL, details about all searches should be returned.

But I'm issuing POST requests and getting the same blurb back. Have you been able to resolve the issue?

[jkat54]

You should get the SID when you submit the search as the returned JSON. This endpoint is for checking the status of jobs when you've already got the SID or if you want to see currently running jobs. When all jobs are complete this endpoint returns the data you're sometimes seeing.

[manhuang]

I called api /services/search/jobs?output_mode=json, and can get sid.
But sometime, it returns info without sid, but some info like error.
we need to call api by auto program, we need to know when will occur these abnormal issue.

[jkat54]

When you create a search you will always get the SID as a response.

When you call this endpoint without specifying the SID you get the status of all the RUNNING jobs. There is a difference between submitting a job, checking the status of a known SID, and checking the status of all jobs.

If you check this endpoint and all jobs are complete... There will not be any SIDS returned.

If you check this endpoint and a job is currently running, then you may get the SID(s) of the running job(s).

If you check this endpont and specify the SID, you'll get the status for that SID.