Getting Data In

REST API search issue in Postman

gartnerj
Explorer

I have the Authorization figured working, but every time I run a search, I get the following error:
(NOTE the AAA/BBB/nnn stuff is just to mask actual values in this post)

<messages>
        <msg type="DEBUG">Configuration initialization for /var/splunkhot/splunk/etc took 112ms when dispatching a search (search ID: 1556216662.24755_33CF52FC-F282-491A-875E-F8EC1EB01F4C)</msg>
        <msg type="DEBUG">Invalid eval expression for 'EVAL-url_length' in stanza [pan:threat]: The expression is malformed. Expected LIKE.</msg>
        <msg type="DEBUG">base lispy: [ AND host::AAAAAAA source::/app/jboss/BBBBBB/log/server.log ]</msg>
        <msg type="DEBUG">search context: user="nnnnnnn", app="search", bs-pathname="/var/splunkhot/splunk/etc"</msg>
    </messages>

The actual search I have in the body of the POST is:

search=search+host%3DAAAAAAA+source%3D%2Fapp%2Fjboss%2BBBBBB%2Flog%2Fserver.log+%7C+search+ERROR+earliest%3D-4h

I've even done just a SIMPLE search:

search=search+host%3DAAAAAAA

and I STILL get an error.

Any ideas what the issue is??

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...