Getting Data In

REST API realtime searches with output_mode set to json

johandk
Path Finder

Not sure if this has been raised before but I couldn't find anything.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" latest_time="rt"

works perfectly.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" latest_time="rt" output_mode="json"

Does not return anything. Is this intended behavior or just a missing feature?

Tags (1)
0 Karma
1 Solution

gstewart
Explorer

Add -d to the http post data requests. So in this case, I believe the correct curl string would be:

curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" -d latest_time="rt" -d output_mode="json"

View solution in original post

gstewart
Explorer

Add -d to the http post data requests. So in this case, I believe the correct curl string would be:

curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" -d latest_time="rt" -d output_mode="json"

ff_djimenez
New Member

This gives me a 404 on Splunk 5.0.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...