Getting Data In

Issues with API using curl - "Method not allowed"

msarro
Builder

I am just starting to dabble with the splunk API. I am following the examples shown in the splunk documentation. The following command gives the following results:

[root@splunk-serv ~]# curl -u admin:changeme -k https://localhost:8089/services/search/jobs/1299860329.83/results/ -d"output_mode=csv"
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='FATAL'>Method Not Allowed</msg></messages></response>

Can anyone provide any pointers on why everything else in the documentation seems to work alright, but this doesn't? Am I querying incorrectly?

Tags (1)

jsperry
Engager

so I've been playing with this, and found that if you add -G to the command, it will work.

man curl:
-G/--get
When used, this option will make all data specified with -d/--data or --data-binary to be used in a HTTP GET request instead of the POST request that otherwise would be used. The data will be appended to
the URL with a '?' separator.

Stephen_Sorkin
Splunk Employee
Splunk Employee

The problem is that using -d"..." causes curl to POST, rather than GET, the resource, which is disallowed from the REST perspective. It should work if you use GET arguments:

curl -u admin:changeme 'https://localhost:8089/services/search/jobs/1299860329.83/results?output_mode=csv'

Stephen_Sorkin
Splunk Employee
Splunk Employee

If that response is empty, that means that the search job had no results. What if you ask for the XML version of the results?

0 Karma

msarro
Builder

When I try this from the command line I get an error stating that the site certificate isn't correct. When I add the --insecure flag, it simply returns to the command prompt.

[root@splunk-serv ~]# curl -u admin:changeme --insecure 'https://localhost:8089/services/search/jobs/1300110780.86/results?output_mode=csv'
[root@splunk-serv ~]#

Going to the same URL via a browser simply shows a blank screen.

0 Karma

msarro
Builder

So the actual documentation is incorrect then? If so I'll submit a support ticket. It seems like a pretty big flaw.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...