Getting Data In

Is there any way via REST to get JSON raw data from Splunk for a given query?


Is there any way how I can get JSON raw data from Splunk for a given query?

Consider the following timechart query:

index=* earliest=<from_time> latest=<to_time> | timechart  span=1s count

Key things in the query are: 1. Start/End Time, 2. Time Span (say sec) and 3. Value (say count)

The expected JSON response would be:

{"fields":["_time","count","_span"], "rows":[["2014-12-25T00:00:00.000-06:00","1460981","1"], ..., ["2014-12-25T01:00:00.000-06:00","536889","1"]]}

This is the XHR (ajax calls) for the output_mode=json_rows calls. This requires session and authentication setups.

I’m looking for a RESTful implementation of the same with authentication.

New Member

If you're looking for a javascript call... here's an example using axios (an npm package i use in my react apps - fetch will also work)

const base_url = ''";
const auth = {username: 'username', password: 'password'};
const search = 'savedsearch yourSavedSearchName';
const params={'output_mode': 'json_cols', search: search}; //no es6 used for clarity

axios.get(base_url, {auth: auth, params: params})
.then((response) => {
//do something with your data
.catch((err) => {
//sth went wrong

Hope this helps someone

0 Karma


Maybe check out the REST API Basic Tutorial

0 Karma


Most specifically the output_mode tag

curl -k -u admin:changeme --data-urlencode search="search index=main earliest=-1m latest=now | timechart count by sourcetype" -d "output_mode=json" https://localhost:8089/servicesNS/admin/search/search/jobs/export

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...