- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issues with API using curl - "Method not allowed"
I am just starting to dabble with the splunk API. I am following the examples shown in the splunk documentation. The following command gives the following results:
[root@splunk-serv ~]# curl -u admin:changeme -k https://localhost:8089/services/search/jobs/1299860329.83/results/ -d"output_mode=csv"
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='FATAL'>Method Not Allowed</msg></messages></response>
Can anyone provide any pointers on why everything else in the documentation seems to work alright, but this doesn't? Am I querying incorrectly?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so I've been playing with this, and found that if you add -G to the command, it will work.
man curl:
-G/--get
When used, this option will make all data specified with -d/--data or --data-binary to be used in a HTTP GET request instead of the POST request that otherwise would be used. The data will be appended to
the URL with a '?' separator.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The problem is that using -d"..." causes curl to POST, rather than GET, the resource, which is disallowed from the REST perspective. It should work if you use GET arguments:
curl -u admin:changeme 'https://localhost:8089/services/search/jobs/1299860329.83/results?output_mode=csv'
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If that response is empty, that means that the search job had no results. What if you ask for the XML version of the results?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I try this from the command line I get an error stating that the site certificate isn't correct. When I add the --insecure flag, it simply returns to the command prompt.
[root@splunk-serv ~]# curl -u admin:changeme --insecure 'https://localhost:8089/services/search/jobs/1300110780.86/results?output_mode=csv'
[root@splunk-serv ~]#
Going to the same URL via a browser simply shows a blank screen.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So the actual documentation is incorrect then? If so I'll submit a support ticket. It seems like a pretty big flaw.
