Getting Data In

REST api no results from sid

bleung93
Path Finder

Splunk 6.1.0 (build 206881)
Mac OSX

input:
curl -u admin:splunker -k https://localhost:8089/services/search/jobs -d'search=search index%3d"*" | stats values(sourcetype) by index'

results:
<?xml version="1.0" encoding="UTF-8"?>

1399707661.62

input:
curl -k -u admin:splunker https://localhost:8089/services/search/jobs/1399707661.62/results/ --get -d output_mode=csv

How do i get the results in the most user friendly way possible? I am currently getting back no results.

Tags (2)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

Ravimrawi
New Member

I'm not getting sid when I curl splunk API. Please assist

Expected output

1258421375.19

Actual output

curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head

https://xxxxxxxxx.xxxxxxxxx.com:8089/services/search/jobs
2016-04-20T11:07:18-04:00

<name>Splunk</name>
0 Karma

bleung93
Path Finder

Thanks you for the response, I will be doing my research into this. Will test out tonight.

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...