Getting Data In

REST api no results from sid

bleung93
Path Finder

Splunk 6.1.0 (build 206881)
Mac OSX

input:
curl -u admin:splunker -k https://localhost:8089/services/search/jobs -d'search=search index%3d"*" | stats values(sourcetype) by index'

results:
<?xml version="1.0" encoding="UTF-8"?>

1399707661.62

input:
curl -k -u admin:splunker https://localhost:8089/services/search/jobs/1399707661.62/results/ --get -d output_mode=csv

How do i get the results in the most user friendly way possible? I am currently getting back no results.

Tags (2)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

Ravimrawi
New Member

I'm not getting sid when I curl splunk API. Please assist

Expected output

1258421375.19

Actual output

curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head

https://xxxxxxxxx.xxxxxxxxx.com:8089/services/search/jobs
2016-04-20T11:07:18-04:00

<name>Splunk</name>
0 Karma

bleung93
Path Finder

Thanks you for the response, I will be doing my research into this. Will test out tonight.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...