Getting Data In

Why has using the rest command to search REST API stopped working after upgrading to 6.5.3?

vanderaj2
Path Finder

Hi,

I used to periodically query the REST API using the search app in Splunk Web, something like so:

| rest /services/deployment/server/clients/ | rename hostname as host utsname as os  | table host os 

I've recently upgraded Splunk Enterprise from 6.4.3 to 6.5.3 and have now noticed that the above search yields no results. Does anyone know what may have changed that has caused this REST command to no longer function?

Thanks!

0 Karma
1 Solution

teunlaan
Contributor

Are you running this on your Deployment server?

| Rest is now running by default only on the local server

try | rest /services/deployment/server/clients/ splunk_server=* | rename hostname as host utsname as os | table host os

View solution in original post

0 Karma

teunlaan
Contributor

Are you running this on your Deployment server?

| Rest is now running by default only on the local server

try | rest /services/deployment/server/clients/ splunk_server=* | rename hostname as host utsname as os | table host os

0 Karma

vanderaj2
Path Finder

That was it! Had to add splunk_server=* to my SPL query for this to work. Thank you!

0 Karma

adonio
Ultra Champion

try this rest command for starters:

| rest /services/deployment/server/clients/

check the correct field names!
looks like the rest of your command has some typos in it:

   ... | rename hostname as host **utsname** as os  | table host os

try instead:

 ... | rename <field1> as 1, <field2> as 2, ... <fieldN> as N | table 1 2 ... N

you can take it from here
hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...