Getting Data In

Is there a way to only get the response with "isDone" using the REST endpoint "search/jobs/{search_id}:"?

Kukkadapu
Path Finder

HI , When I try to get the status of the search_id using the REST endpoint "search/jobs/{search_id}: ", I see a lot of information in the response. Is there a way to only get the response to check the status of the job i.e. the field - "isDone" (without all the other information)

0 Karma
1 Solution

cmerriman
Super Champion

as far as i know, you just add something like |where isDone=1 to filter if the job is done or not. Otherwise you do a |fields isDone otherFields to only show fields you're interested in. I don't believe you can do this all in the rest command.

View solution in original post

cmerriman
Super Champion

as far as i know, you just add something like |where isDone=1 to filter if the job is done or not. Otherwise you do a |fields isDone otherFields to only show fields you're interested in. I don't believe you can do this all in the rest command.

Kukkadapu
Path Finder

Thanks for the reply cmerriman. We are calling the endpoint from the Java based app and is there any way to get only isDone instead of the whole payload?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...