Getting Data In

Not able to retrieve Splunk data using Splunk REST API

mala_splunk_91
Explorer

Hi

I want to pull data out of Splunk.
So, Im using REST API to export data which uses CURL call.
For example:am trying below

curl -ku username:pass https://:/services/search/jobs --data-urlencode 'search=search index="_internal" | stats count(eval(sourcetype LIKE "splunk'%'")) AS st_splunk count AS total by host'

I get SID as result and I ran below one

curl -ku username:pass https://:/services/search/jobs//results/ -d output_mode=csv -d count=50000 -d offset=0 -o /tmp/my-output.csv

"result:

<msg type="FATAL">Method Not Allowed</msg>

Why no result found? What ma missing?
Please help on this.
Thanks in advance.
Mala S

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Looks like you’re very close but have the wrong URL for getting results.

Follow the “make sure you do” section here:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/ExportdatausingRESTAPI

0 Karma

jkat54
SplunkTrust
SplunkTrust

Found in step 3 on the link I gave.

Also note the comment someone left about 7.1.1 saying they had to use this endpoint.

https://localhost:8089/servicesNS/admin/search/search/jobs/1423855196.339/results

0 Karma

mala_splunk_91
Explorer

We need to pull data and collected in remote server which has connection with Splunk UI
So, Am running this CURL commands in remote server to pull data out of splunk UI server.
(Remote servers is separate Application server which needs splunk data).

so, this is the case, Can I do this by REST API app? or how can i pull out of splunk?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yes, but you have to build your own REST API app.

Using instructions here:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/ExportdatausingRESTAPI

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Use the REST API TA in Splunkbase. It's free and works great

https://splunkbase.splunk.com/app/1546/

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...