Getting Data In

REST API returns empty results when launched from Windows Task Scheduler

marcelofinki
Explorer

I developed an application that uses REST API to run a search (and then do other things).

This application is launched by the Windows Task Scheduler.

On version 4.0.9 and also some releases of version 4.1 this used to work fine.

Days ago i tried to install latest version and this stopped working.

Now if I run the application from a CMD window, everything works "as expected". But when i open the "Scheduled Tasks" window and go "right-click > Run" on the very same application, the query always comes up empty.

Any ideas? Thanks In Advance, Marcelo

Tags (2)
0 Karma

Suda
Communicator

Hello,

I faced the similer issue with Splunk 4.1.6 running on Windows 2003. I saw some application error events for "splunk.exe" in Windows Application Event logs.

I finally found that my case was caused by SPL-36206. It has been fixed in Splunk 4.1.7. Splunk 4.1.7 release notes says...

Splunk Launcher CLI crashes when HOMEPATH env variable not set. (SPL-36206)

When my batch file is launched by Task Scheduler, HOMEPATH environment variable is not set, I confirm.

Could you try to set the "HOMEPATH" environment variable before launching "splunk.exe"? Or could you upgrade Splunk to 4.1.7?

My current batch file is ...

SET HOMEDRIVE=C:
SET HOMEPATH=\TEMP
"C:\Program files\Splunk\bin\splunk.exe" search "<my search command>" -app search -auth admin:changeme

I hope this information helps you.

Thanks.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!