metadata via REST API

[stuartamurray]

Guys,
From the Search app I do the following search:

| metadata type=hosts

This correctly yields a table of the reporting hosts. I am using SplunkNet to provide remote search capability. This seems to work fine for a normal search but not for the metadata search defined above.

Looking at the rendered search in each case the REST call uses POST method with the following payload:
search=%7c+metadata+type%3dhosts&enable_lookup=False

This looks fairly reasonable but returns no events (expected as this is just metadata) but more importantly no results. In fact the response.CanRead flag is set to false, which would tend to suggest there are no records available.

Is this sort of search supported via REST?

Many thanks

[ziegfried]

Yes, the metadata search can be executed via REST. I can't tell the specifics of the SplunkNet API, but the search string should not start with a leading |. I've just successfully tested it with the following POST data:

search=metadata%20type%3Dhosts

Here is a simple example how this is done using curl:

Dispatch the job:

$curl -k -u admin:changeme -d "search=metadata%20type%3Dhosts" https://localhost:8089/services/search/jobs

Response:

<?xml version='1.0' encoding='UTF-8'?>
<response><sid>1308072253.175</sid></response>

Fetch the results:

curl -k -u admin:changeme https://localhost:8089/services/search/jobs/1308072253.175/results?output_mode=json

Response:

<... the results ...>

[stuartamurray]

Awesome! Much appreciated. Always the simple things that trip us up!!