Getting Data In

REST API: searching piped into stats, no events available

twinspop
Influencer

If I run this search through the web interface:

error | stats count by host | sort - count

And then venture over to port 8089 and check the job, I can see the search summary and hit the Events link at the bottom of the page to get a list of the events.

However, if I run that search through the REST API, the Events link goes to an empty page. How can I get a list of the events from that search using the REST API?

Thanks, Jon

Tags (3)
0 Karma

twinspop
Influencer

If I set the status_buckets POST variable to 300 (as the is the default from the web interface search), I get eventAvailableCount > 0.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: State of Observability - Where AI Meets Performance

As AI agents take on more complex tasks, teams need greater visibility into how they behave, what they cost, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Build resilience for the agentic era: Join us at Splunk Go San Jose

AI is changing how organizations build, operate, and secure digital services. As teams adopt AI agents and ...