Getting Data In

Doing search through REST API using PostMan giving [Error in 'SearchParser']

ebeid
New Member

same query return results on Splunk web interface.
alt text

0 Karma
1 Solution

damien_chillet
Builder

You should try removing the quotes,

Posting a job using SDK, the POST data looks as following:

search=search+index%3D_internal+component%3D%2A

(Special characters are URL encoded - no quotes)

View solution in original post

0 Karma

damien_chillet
Builder

You should try removing the quotes,

Posting a job using SDK, the POST data looks as following:

search=search+index%3D_internal+component%3D%2A

(Special characters are URL encoded - no quotes)

0 Karma

vlsnkakitha
Observer

iam able to invoke login API from postman and getting session key as XML response.

but when i invoke create search API with that session key in request header and search query in request body, giving HTTP 200 response but no search id is created. getting some html content like "Splunk relies on javascript to function properly. please enable and reload the page". how to resolve this error and get the searchid created

0 Karma

ebeid
New Member

@damien_chillet any idea how to provide time frame for the search ? and export format ?

0 Karma

damien_chillet
Builder

Example below to export results in JSON:

POST /services/search/jobs/export HTTP/1.1

   output_mode=json&segmentation=none&latest_time=2017-12-12T00%3A00%3A00.000&earliest_time=2017-12-11T00%3A00%3A00.000&search=search+index%3D_internal+component%3D%2A+%7C+head+100
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...