Splunk Dev

Splunk Java SDK: How do you query a macro defined in a custom app instead of the default splunk search app?

dinh
Path Finder

I have a custom app defined. I want to query a macro defined in it. The samples provided here (http://code.google.com/p/splunk-java-sdk/w/list) call splunk's search app by default. How do I get it to call my custom app instead?

Tags (2)
0 Karma
1 Solution

dinh
Path Finder

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

View solution in original post

psanford_splunk
Splunk Employee
Splunk Employee

We are currently building out a new Java SDK. It will be available on GitHub. I can give pre-release access - just need a GitHub ID.

Any questions - psanford@splunk.com or ping us on Twitter: @splunkdev

wcolgate_splunk
Splunk Employee
Splunk Employee

The Java SDK supports namespaces for exactly this reason.

0 Karma

dinh
Path Finder

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

wcolgate_splunk
Splunk Employee
Splunk Employee

While the URLs are correct, the Java SDK (which the OP refers to), supports namespaces. There is a description here: http://dev.splunk.com/view/SP-CAAAECN#namespaces

0 Karma

Johnvey
Contributor

If you are using the SDK from the current source, you can specify an optional namespace parameter when dispatching a job to target a specific app. See the inline docs here:

http://code.google.com/p/splunk-java-sdk/source/browse/trunk/SplunkSDK/src/com/splunk/sdk4x/search/J...

Note that the SDK is not considered stable for 4.0. Read more about Splunk's SDKs and APIs.

dinh
Path Finder

I set the namespace in the my job parameters and I see it go out on the POST, but it is still not working. I get the same error as before which is that it could not find the macro. I'm wondering if the REST api is even looking at the namespace parameter.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...