Getting Data In

Issues with API using curl - "Method not allowed"

msarro
Builder

I am just starting to dabble with the splunk API. I am following the examples shown in the splunk documentation. The following command gives the following results:

[root@splunk-serv ~]# curl -u admin:changeme -k https://localhost:8089/services/search/jobs/1299860329.83/results/ -d"output_mode=csv"
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='FATAL'>Method Not Allowed</msg></messages></response>

Can anyone provide any pointers on why everything else in the documentation seems to work alright, but this doesn't? Am I querying incorrectly?

Tags (1)

jsperry
Engager

so I've been playing with this, and found that if you add -G to the command, it will work.

man curl:
-G/--get
When used, this option will make all data specified with -d/--data or --data-binary to be used in a HTTP GET request instead of the POST request that otherwise would be used. The data will be appended to
the URL with a '?' separator.

Stephen_Sorkin
Splunk Employee
Splunk Employee

The problem is that using -d"..." causes curl to POST, rather than GET, the resource, which is disallowed from the REST perspective. It should work if you use GET arguments:

curl -u admin:changeme 'https://localhost:8089/services/search/jobs/1299860329.83/results?output_mode=csv'

Stephen_Sorkin
Splunk Employee
Splunk Employee

If that response is empty, that means that the search job had no results. What if you ask for the XML version of the results?

0 Karma

msarro
Builder

When I try this from the command line I get an error stating that the site certificate isn't correct. When I add the --insecure flag, it simply returns to the command prompt.

[root@splunk-serv ~]# curl -u admin:changeme --insecure 'https://localhost:8089/services/search/jobs/1300110780.86/results?output_mode=csv'
[root@splunk-serv ~]#

Going to the same URL via a browser simply shows a blank screen.

0 Karma

msarro
Builder

So the actual documentation is incorrect then? If so I'll submit a support ticket. It seems like a pretty big flaw.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...