REST API returns empty results when launched from Windows Task Scheduler

[marcelofinki]

I developed an application that uses REST API to run a search (and then do other things).

This application is launched by the Windows Task Scheduler.

On version 4.0.9 and also some releases of version 4.1 this used to work fine.

Days ago i tried to install latest version and this stopped working.

Now if I run the application from a CMD window, everything works "as expected". But when i open the "Scheduled Tasks" window and go "right-click > Run" on the very same application, the query always comes up empty.

Any ideas? Thanks In Advance, Marcelo

[Suda]

Hello,

I faced the similer issue with Splunk 4.1.6 running on Windows 2003. I saw some application error events for "splunk.exe" in Windows Application Event logs.

I finally found that my case was caused by SPL-36206. It has been fixed in Splunk 4.1.7. Splunk 4.1.7 release notes says...

Splunk Launcher CLI crashes when HOMEPATH env variable not set. (SPL-36206)

When my batch file is launched by Task Scheduler, HOMEPATH environment variable is not set, I confirm.

Could you try to set the "HOMEPATH" environment variable before launching "splunk.exe"? Or could you upgrade Splunk to 4.1.7?

My current batch file is ...

SET HOMEDRIVE=C:
SET HOMEPATH=\TEMP
"C:\Program files\Splunk\bin\splunk.exe" search "<my search command>" -app search -auth admin:changeme

I hope this information helps you.

Thanks.