Getting Data In

Call Splunk API to Get Sid

manhuang
Explorer

I make a call to the Splunk REST API to get sid.
api is /services/search/jobs?output_mode=json
In a general way, it will return an sid like 1464774202.16228 for me to get a final result.
But sometimes, it will return me a lot of info without sid, but dispatchState is Done.
Seems like something does not work.
Why do I get a result like this?

Tags (2)
1 Solution

jkat54
SplunkTrust
SplunkTrust
0 Karma

jkat54
SplunkTrust
SplunkTrust
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/search/jobs --data-urlencode search="search index=_internal source=*/metrics.log" -d id=mysearch_02151949

slw07gdev
Explorer

thank you!

jkat54
SplunkTrust
SplunkTrust

Anytime!!!

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can also specify the id you want. Do you see in the documentation how to expand the "post" section to see all the parameters?

slw07gdev
Explorer

I'm experiencing the same issue. Trying to create a search, but getting unexpected data back.

When issuing a GET request to the URL, details about all searches should be returned.

But I'm issuing POST requests and getting the same blurb back. Have you been able to resolve the issue?

jkat54
SplunkTrust
SplunkTrust

You should get the SID when you submit the search as the returned JSON. This endpoint is for checking the status of jobs when you've already got the SID or if you want to see currently running jobs. When all jobs are complete this endpoint returns the data you're sometimes seeing.

0 Karma

manhuang
Explorer

I called api /services/search/jobs?output_mode=json, and can get sid.
But sometime, it returns info without sid, but some info like error.
we need to call api by auto program, we need to know when will occur these abnormal issue.

0 Karma

jkat54
SplunkTrust
SplunkTrust

When you create a search you will always get the SID as a response.

When you call this endpoint without specifying the SID you get the status of all the RUNNING jobs. There is a difference between submitting a job, checking the status of a known SID, and checking the status of all jobs.

If you check this endpoint and all jobs are complete... There will not be any SIDS returned.

If you check this endpoint and a job is currently running, then you may get the SID(s) of the running job(s).

If you check this endpont and specify the SID, you'll get the status for that SID.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...