Getting Data In

REST API Specific Search

domtheluck
Explorer

Hi,

I try to do a search with Splunk REST API from a C# client.

I need to search some general term but I need to specify some information like the host, index etc.

Here is my query:

url:
https:1.1.1.1:8089/services/search/jobs

Args in request body:
search=search SOMETERMTOSEARCH host=HOSTNAMETOSEARCHWITHIN

Right now, it work if I specificy only the SOMETERMTOSEARCH. If I add the host=HOSTNAMETOSEARCHWITHIN, Splunk truncated it to search=search SOMETERMTOSEARCH host=. Same thing if I add index=MYINDEXNAME.

How can I specify these extra parameters?

i try to add them as arguments like earliest_time or latest_time but it's not work either.

Can someone help me?

Tags (1)
0 Karma

ugavnholt
Engager

It sounds like you should urlEncode the portion of the string that are a value, ie:
"search=" + UrlEncode("search SOMETERMTOSEARCH host=HOSTNAMETOSEARCHWITHIN")

0 Karma

domtheluck
Explorer

Thanks for your quick answer!

I will contact you shortly with my GitHub ID.

0 Karma

psanford_splunk
Splunk Employee
Splunk Employee

Hi - We will be releasing our C# SDK shortly and that should be able to help you. We can give you pre-release access now. Just send an email to: devinfo@splunk.com with your GitHub ID and we will get you access.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...