From the Search app I do the following search:
| metadata type=hosts
This correctly yields a table of the reporting hosts. I am using SplunkNet to provide remote search capability. This seems to work fine for a normal search but not for the metadata search defined above.
Looking at the rendered search in each case the REST call uses POST method with the following payload:
This looks fairly reasonable but returns no events (expected as this is just metadata) but more importantly no results. In fact the response.CanRead flag is set to false, which would tend to suggest there are no records available.
Is this sort of search supported via REST?
Yes, the metadata search can be executed via REST. I can't tell the specifics of the SplunkNet API, but the search string should not start with a leading
|. I've just successfully tested it with the following POST data:
Here is a simple example how this is done using curl:
Dispatch the job:
$curl -k -u admin:changeme -d "search=metadata%20type%3Dhosts" https://localhost:8089/services/search/jobs
<?xml version='1.0' encoding='UTF-8'?> <response><sid>1308072253.175</sid></response>
Fetch the results:
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/1308072253.175/results?output_mode=json
<... the results ...>