connecting Rest API from R

[debraj]

Hi,

I am trying to perform search using rest api from R language. This is the curl I am using which is available in splunk doc.

curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search *"

I am using httr GET method in R. Below is the sample code. When I use the curl I get a sid in response. But the same process when I run from R it returns all the search details. Not able to figure what I am missing out in below code.

response <- GET(splunk_server,
path=search_job_export_endpoint,
config(ssl_verifyhost=FALSE, ssl_verifypeer=0),
authenticate(username, password),
query=list(search=urlencode(search_terms)),

verbose())

What does -d in curl exactly do ?

[acharlieh]

-d is to specify data for an HTTP POST body as is described in man curl. So you want to actually POST (not GET) a form with a search parameter set to the search you want to perform.

You may also be interested in the search REST API docs which go into detail about the GET and POST methods, as well as parameters that can be used with each. Also there are some tutorials that get into the different search modes and how to poll for results, and clean up jobs if needed.

---

EDIT TO ADD: After figuring out how to download, install, and run R and and install install httr, could this give you a better starting point?

install.packages("httr")
library(httr)
r <- POST(splunk_server, 
          path = "services/search/jobs",
          config( ssl_verifyhost = FALSE, ssl_verifypeer = 0),
          authenticate(username, password),
          encode = "form",
          body = list( search = "noop | stats count",
                       exec_mode = "oneshot",
                       output_mode = "json" ), 
          verbose())
stop_for_status(r)
content(r, "parsed", "application/json")$results

Of course splunk_server is the url to the API port (default: https://servername:8089) and you'd of course fill in your own search for the search parameter (instead of my count nothing: noop | stats count, you'd likely have search | ...), and send along other parameters as needed from the REST API documentation as needed.

[debraj]

Thanks for clarification. I am getting same result with POST as well.