Getting Data In

Why is my Splunk events search not working with curl?

mukesh2019
Explorer

Hi Everybody,

I was trying to run the below search events commands with Splunk but I'm getting incorrect data.The count should have been 747, but its 0. Please suggest.

curl -k -u user:pass https://host.domain.com:8089/services/search/jobs --get -d search="index=1234_nontricare  source=/abc/logs/cpp*atch/aep/bw-monitoring-gsspcc.log| stats count as Total" -d output_mode=json

<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
     . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
      . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
   . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
 <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" 
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>jobs</title>
<id>https://host.domain.com:8089/services/search/jobs</id>
<updated>2018-12-19T09:56:22-05:00</updated>
<generator build="59c8927def0f" version="6.5.0"/>
<author>
<name>Splunk</name>
</author>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>0</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
</feed>

Thanks in Advance .Apologies for not editing properly.

0 Karma
1 Solution

whrg
Motivator

Hello @mukesh2019,

The services/search/jobs endpoint, which you are using, is for 1) getting details of all current searches (GET) or 2) starting a new search and return the search ID (POST).

It looks like you want to run a oneshot search. I think you are better off here with the services/search/jobs/export endpoint.

Here is an example:

curl -k -u user:password https://yoursplunkserver:8089/services/search/jobs/export -d search="search index%3D_internal | head 5" -d output_mode=csv

View solution in original post

whrg
Motivator

Hello @mukesh2019,

The services/search/jobs endpoint, which you are using, is for 1) getting details of all current searches (GET) or 2) starting a new search and return the search ID (POST).

It looks like you want to run a oneshot search. I think you are better off here with the services/search/jobs/export endpoint.

Here is an example:

curl -k -u user:password https://yoursplunkserver:8089/services/search/jobs/export -d search="search index%3D_internal | head 5" -d output_mode=csv
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...