Splunk Rest API: How to pass parameters in search

[vaibhavagg2006]

HI,
I have an requirement to create splunk rest api which can accept inputs and pass it to the search. Search will accept the parameters and generate the results. API should send back the results. Also how can I manage authentication in this. Please provide me the pointers for the same.

[jkat54]

First you'll want to get a sessionid from the auth endpoints.

Second you'll want to execute a search from the search endpoints and record the search id. This will require the sessionid.

Then you'll want to get the results from the search endpoints after verifying the search has completed. Both steps here will require the search id & sessionid.

There's plenty of documentation on the Splunk rest api. There is no need to create your own api.

http://dev.splunk.com/restapi

As we aren't in the business of writing your code for you, I hope you can use a search engine to fill in the blanks.

Best of luck! Let us know if you have difficulties with the api.

[vaibhavagg2006]

Hi
Thanks for your inputs. I am looking for an endpoint through which I can pass parameters to my search. Can we call a macro using rest api.

[neeldesai1992]

did you get the answer of this question?

[jkat54]

Absolutely. You'd have to escape the single quotes on the Marco but you can do this via the search endpoints.