Getting Data In

metadata via REST API

Path Finder

From the Search app I do the following search:

| metadata type=hosts

This correctly yields a table of the reporting hosts. I am using SplunkNet to provide remote search capability. This seems to work fine for a normal search but not for the metadata search defined above.

Looking at the rendered search in each case the REST call uses POST method with the following payload:

This looks fairly reasonable but returns no events (expected as this is just metadata) but more importantly no results. In fact the response.CanRead flag is set to false, which would tend to suggest there are no records available.

Is this sort of search supported via REST?

Many thanks

Tags (2)
0 Karma


Yes, the metadata search can be executed via REST. I can't tell the specifics of the SplunkNet API, but the search string should not start with a leading |. I've just successfully tested it with the following POST data:


Here is a simple example how this is done using curl:

Dispatch the job:

$curl -k -u admin:changeme -d "search=metadata%20type%3Dhosts" https://localhost:8089/services/search/jobs


<?xml version='1.0' encoding='UTF-8'?>

Fetch the results:

curl -k -u admin:changeme https://localhost:8089/services/search/jobs/1308072253.175/results?output_mode=json


<... the results ...>

Path Finder

Awesome! Much appreciated. Always the simple things that trip us up!!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...