Getting Data In

accessing saved report data in json/xml from Splunk RESTful API

tommyp1972
New Member

I have tried to access a saved report through a browser URL using Splunk's RESTful API. I cannot seem to accomplish this. I am using my_domain:8089/servicesNS/my_user/my_app/ but from there I am lost. Where are the reports in the endpoints? I can't find anything in the documentation. I am using Splunk 4.3.6

Tags (3)
0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

All the end points are available on Splunk docs at http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTlist. A couple that you might find useful from this list - saved/searches/{name} and search/jobs/{search_id}/results.

We also have SDKs in 6 different languages. They make it much easier to hit these endpoints and get data from searches and reports from Splunk. You can can find more about the SDKs at http://dev.splunk.com/view/sdks/SP-CAAADP7.

Neeraj_Luthra
Splunk Employee
Splunk Employee

I don't think 4.x supports these but with 5.x and higher, following 2 URLs can be used from the browser for a quick check.

https://localhost:8089/services/search/jobs/oneshot?search=search%20index%3D_internal%20head%201

OR
https://localhost:8089/services/search/jobs/export?search=search%20index%3D_internal%20head%201

0 Karma

tommyp1972
New Member

OK. Thanks. I was just trying to access the report/saved search via the browser, not curl or php or whatever. Can this not be done just as a quick proof of concept? I found the saved search, not report, from your information above. However, it apepars that that is just to see the configuration or delete it or whatever. I just want the search's output. So I saw this->search/search/jobs/export/ . . . I just don't know how to feed it my search string. I see that your documentation provides Curl examples. But again I just want to do this in a browser with a http request.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...