Getting Data In

Splunk using rest api to fetch app name / id

Dawson014
Path Finder

Hello fellow Splunkers,

I am using the following query to fetch the splunk app name in standalone search head -

| rest /services/search/jobs splunk_server=local 
| addinfo 
| where sid = info_sid 
| rename eai:acl.app as app_name
| fields + app_name

However, this same query is not working in SHC. It shows No results found
Any suggestions would be appreciated.

Thanks!

1 Solution

sdawsonkg
Path Finder

If you're running the query on a dashboard then this should work -

<your_base_query>
| eval app_name = $env:app$
| ...

However, this will not work if you are running the query on a search panel.

View solution in original post

sdawsonkg
Path Finder

If you're running the query on a dashboard then this should work -

<your_base_query>
| eval app_name = $env:app$
| ...

However, this will not work if you are running the query on a search panel.

Dawson014
Path Finder

This will do. Thanks!

sdawsonkg
Path Finder

Good. Cheers!

renjith_nair
Legend

Hi @Dawson014,
Try running just | rest /services/search/jobs and see if it works

---
What goes around comes around. If it helps, hit it with Karma 🙂

Dawson014
Path Finder

Tried this, worked once. Then again the same No Results founds

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...