Doing search through REST API using PostMan giving [Error in 'SearchParser']

[ebeid]

same query return results on Splunk web interface.

[damien_chillet · Accepted solution]

You should try removing the quotes,

Posting a job using SDK, the POST data looks as following:

search=search+index%3D_internal+component%3D%2A

(Special characters are URL encoded - no quotes)

[vlsnkakitha]

iam able to invoke login API from postman and getting session key as XML response.

but when i invoke create search API with that session key in request header and search query in request body, giving HTTP 200 response but no search id is created. getting some html content like "Splunk relies on javascript to function properly. please enable and reload the page". how to resolve this error and get the searchid created

[ebeid]

@damien_chillet any idea how to provide time frame for the search ? and export format ?

[damien_chillet]

Example below to export results in JSON:

POST /services/search/jobs/export HTTP/1.1

   output_mode=json&segmentation=none&latest_time=2017-12-12T00%3A00%3A00.000&earliest_time=2017-12-11T00%3A00%3A00.000&search=search+index%3D_internal+component%3D%2A+%7C+head+100