Getting Data In
Highlighted

Doing search through REST API using PostMan giving [Error in 'SearchParser']

New Member

same query return results on Splunk web interface.
alt text

0 Karma
Highlighted

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

You should try removing the quotes,

Posting a job using SDK, the POST data looks as following:

search=search+index%3D_internal+component%3D%2A

(Special characters are URL encoded - no quotes)

View solution in original post

0 Karma
Highlighted

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

New Member

@damien_chillet any idea how to provide time frame for the search ? and export format ?

0 Karma
Highlighted

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

Example below to export results in JSON:

POST /services/search/jobs/export HTTP/1.1

   output_mode=json&segmentation=none&latest_time=2017-12-12T00%3A00%3A00.000&earliest_time=2017-12-11T00%3A00%3A00.000&search=search+index%3D_internal+component%3D%2A+%7C+head+100
0 Karma