Is there a way to paginate search results ?

[lmeur]

I'm able to limit number of results with "head ${number}" expression but what I need is to grab a page from a search job with REST Api (for example the 3rd page of 100 elements) to limit bandwith usage when we grab search results from Splunk REST Api.

Is there a way to do this with search language or Rest API or both ?

Ludovic.

[sideview · Accepted solution]

in the API you can specify an offset argument, and a count argument, and that will do the paging for you.

http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch

More Advanced:: If you ever want to do really complex things where you actually transform the result set and then paginate the transformed result set you can do that too although it requires a lot more familiarity with the system to avoid certain pitfalls. In that case when you are making your GET request to the results endpoint, you would use the 'search' argument. This is called a 'postprocess search' fwiw. And you can combine the search with the offset and count args as well I believe they place nice together.

http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch

[organus]

The link seems to be broken.

[rkantamaneni_sp]

Old: https://docs.splunk.com/Documentation/Splunk/4.3/Developer/RESTSearch

New: https://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTsearches#Tips_on_creating_searches

Both Tips Sections