Getting Data In

We are getting an error when trying to create a search job using the REST API ?

Hemnaath
Motivator

Hi All, Could you please guide us in getting this issue resolved, currently one of the developer is trying to create a search job using the REST API, as per the splunk document he had followed the same steps ("splunk.xxxxx.com/services/search/jobs") but he is getting this message The path '/en-US/services/search/jobs' was not found , even with admin user id we are getting the same message as soon as we clicks the link, not sure how to fix this issue as have do not have much idea on REST API concept.
So kindly guide us what we need to do to get this fixed for the user.

Splunk version 6.2.1
Linux OS

0 Karma

Hemnaath
Motivator

hi rroberts, thanks for sharing some document, as I had told we do not have much idea on REST API, so kindly guide me what I need to look in the document which you had shared as it got lots of information and the same time if you can share me the steps to trouble shoot this issues instead of sharing the documents.

unable to understand the example which you had shared in your comments, so kindly guide us what exactly we need to follow to fix this issue.

thanks in advance.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @Hemnaath,

If you are just getting started with the REST API, you might want to check out this user guide:
http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing

Hope this helps you start troubleshooting. You might also want to post an example cURL request and response here to provide more detail on what you're seeing and what you're trying to do.

0 Karma

rroberts
Splunk Employee
Splunk Employee

This documentation might help:
http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTsearch
https://splunk.server.com:8089/services/search/jobs
We also have an 8 hour SDK course covering REST API, etc ...
http://www.splunk.com/view/SP-CAAAHSH
Here's an example from the docs dispatching a search request: curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/search/jobs --data-urlencode search="search index=_internal source=*/metrics.log" -d id=mysearch_02151949 -d max_count=50000 -d status_buckets=300

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!