Getting Data In

Splunk using rest api to fetch app name / id

Dawson014
Path Finder

Hello fellow Splunkers,

I am using the following query to fetch the splunk app name in standalone search head -

| rest /services/search/jobs splunk_server=local 
| addinfo 
| where sid = info_sid 
| rename eai:acl.app as app_name
| fields + app_name

However, this same query is not working in SHC. It shows No results found
Any suggestions would be appreciated.

Thanks!

1 Solution

sdawsonkg
Path Finder

If you're running the query on a dashboard then this should work -

<your_base_query>
| eval app_name = $env:app$
| ...

However, this will not work if you are running the query on a search panel.

View solution in original post

sdawsonkg
Path Finder

If you're running the query on a dashboard then this should work -

<your_base_query>
| eval app_name = $env:app$
| ...

However, this will not work if you are running the query on a search panel.

View solution in original post

Dawson014
Path Finder

This will do. Thanks!

sdawsonkg
Path Finder

Good. Cheers!

renjith_nair
SplunkTrust
SplunkTrust

Hi @Dawson014,
Try running just | rest /services/search/jobs and see if it works

Dawson014
Path Finder

Tried this, worked once. Then again the same No Results founds

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!