REST api no results from sid

[bleung93]

Splunk 6.1.0 (build 206881)
Mac OSX

input:
curl -u admin:splunker -k https://localhost:8089/services/search/jobs -d'search=search index%3d"*" | stats values(sourcetype) by index'

results:
<?xml version="1.0" encoding="UTF-8"?>

1399707661.62

input:
curl -k -u admin:splunker https://localhost:8089/services/search/jobs/1399707661.62/results/ --get -d output_mode=csv

How do i get the results in the most user friendly way possible? I am currently getting back no results.

[rsennett_splunk · Accepted solution]

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

[Ravimrawi]

I'm not getting sid when I curl splunk API. Please assist

Expected output

1258421375.19

Actual output

curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head

https://xxxxxxxxx.xxxxxxxxx.com:8089/services/search/jobs
2016-04-20T11:07:18-04:00

<name>Splunk</name>

[bleung93]

Thanks you for the response, I will be doing my research into this. Will test out tonight.