I am using Splunk Java SDK to fetch data from Splunk index.
I have the below in my splunk server.
User - Customer_1_User1
Role - customer1_role (which have access to only customer1_index)
Saved Search Name - test_savedsearch
I am connecting to splunk from the java application (using Splunk Java SDK) using below code snippet
loginArgs.setUsername("Customer_1_User1"));
loginArgs.setPassword("xxxx"));
loginArgs.setHost("splunkHostName"));
loginArgs.setPort(8059);
Service splunkService = Service.connect(loginArgs)
//Get the earliest and latest time
SavedSearchDispatchArgs savedSearchDispatchArgs = getEarliestAndLatestTime();
SavedSearchCollection savedSearches = splunkService.getSavedSearches();
SavedSearch savedSearch = splunkService.getSavedSearches().get("test_savedsearch");
Job jobSavedSearch = savedSearch.dispatch(savedSearchDispatchArgs);
Map<String, Object> arguments = new HashMap<String, Object>();
arguments.put("count", 0);
InputStream resultsNormalSearch = jobSavedSearch.getResults(arguments);
ResultsReaderXml resultsReaderNormalSearch = new ResultsReaderXml(resultsNormalSearch);
//fetch data from resultsReaderNormalSearch
When I am trying to fetch data from test_savedsearch through java its returning 500 records.
'customer1_index' has 150 records only. Its fetching 150 records properly when I run the saved search in splunk.
Why its fetching all data through java application irrespective of roles/index defined to the user??
Please help to resolve this issue.
Please add the lines of code where you actually start the search, fetch the results etc.
updated my code. Please have a look.