search a query on splunk using the rest api

[vagdevi]

Hi,

I want to create a rest api request to create a search in splunk and get the details(logs) of the search result. I have gone through the splunk document provided by the splunk team, but couldn't get the response properly. I am trying all the ways to hit splunk and search, but it isn't work. I am using basic auth for the request in postman .Please help me to get through this. I am attaching the splunk we are using and the search query we have to use and also the postman request to hit the same

I want to use only postman for the search, not a curl command. 

[scelikok]

I used a sample simple search that is short and  can run anywhere. Screenshots are for you to compare with yours since you told your getting "error not found". 

The only thing you need to do is change the search parameter value with your search. You should see your results in postman.

[scelikok]

Hi @vagdevi,

I am attaching the postman screenshot with a working example. Please check what is different?

[vagdevi]

Thanks for the screenshots, but i want to have the logs out from splunk thru postman, not just the count,

[scelikok]

Hi @vagdevi,

Please try with jobs/export endpoint like below, it will work with basic or bearer token auth. 

https://splunk_server:8089/services/search/jobs/export?search=search index=_internal earliest=-1d latest=now | stats count by host&output_mode=json

[vagdevi]

Hi @scelikok , 

Thanks for the reply

I tried the query you provide, but couldn't get the output. It says error not found. 

[awslabspl]

Better to use different tool and leave Splunk all alone. Not worth even trying. Awful community. Awful UI/UX, almost imaginary docs..........

Also I wouldnt risk downloading files from them (if you are thinking of self-hosting this ).

[vagdevi]

but, we are supposed to use splunk for monitoring the logs, as per client