Getting Data In

REST api no results from sid

bleung93
Path Finder

Splunk 6.1.0 (build 206881)
Mac OSX

input:
curl -u admin:splunker -k https://localhost:8089/services/search/jobs -d'search=search index%3d"*" | stats values(sourcetype) by index'

results:
<?xml version="1.0" encoding="UTF-8"?>

1399707661.62

input:
curl -k -u admin:splunker https://localhost:8089/services/search/jobs/1399707661.62/results/ --get -d output_mode=csv

How do i get the results in the most user friendly way possible? I am currently getting back no results.

Tags (2)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

Ravimrawi
New Member

I'm not getting sid when I curl splunk API. Please assist

Expected output

1258421375.19

Actual output

curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head

https://xxxxxxxxx.xxxxxxxxx.com:8089/services/search/jobs
2016-04-20T11:07:18-04:00

<name>Splunk</name>
0 Karma

bleung93
Path Finder

Thanks you for the response, I will be doing my research into this. Will test out tonight.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!