How to enable REST endpoints so that users can use other tools to grab data from Splunk?

[kteng2024]

How to enable REST endpoints so that users can use other tools to grab data from Splunk? Port 8089 is already opened. But when i paste the search head URL along with port number, all i could see HTML data but not the JSON data from Splunk.

[vasanthmss]

try to add the query parameter with output_mode=json.

https://<yourhost>:<mgnt_port>/.../../..?output_mode=json

Read this, http://docs.splunk.com/Documentation/Splunk/6.6.0/RESTTUT/RESTsearches

You can return search results in JSON, CSV or XML by setting the output_mode parameter. By default, results are returned in XML format.

For example, to retrieve search results in JSON format, make the following call.

Note: The curl listing includes --get because you are passing a parameter to a GET operation.

curl -u admin:changeme \
     -k https://localhost:8089/services/search/jobs/1258421375.19/results/ \
     --get -d output_mode=json