Splunk Java SDK: How do you query a macro defined in a custom app instead of the default splunk search app?

[dinh]

I have a custom app defined. I want to query a macro defined in it. The samples provided here (http://code.google.com/p/splunk-java-sdk/w/list) call splunk's search app by default. How do I get it to call my custom app instead?

[psanford_splunk]

We are currently building out a new Java SDK. It will be available on GitHub. I can give pre-release access - just need a GitHub ID.

Any questions - psanford@splunk.com or ping us on Twitter: @splunkdev

[wcolgate_splunk]

The Java SDK supports namespaces for exactly this reason.

[dinh · Accepted solution]

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

[wcolgate_splunk]

While the URLs are correct, the Java SDK (which the OP refers to), supports namespaces. There is a description here: http://dev.splunk.com/view/SP-CAAAECN#namespaces

[Johnvey]

If you are using the SDK from the current source, you can specify an optional namespace parameter when dispatching a job to target a specific app. See the inline docs here:

http://code.google.com/p/splunk-java-sdk/source/browse/trunk/SplunkSDK/src/com/splunk/sdk4x/search/J...

Note that the SDK is not considered stable for 4.0. Read more about Splunk's SDKs and APIs.

[dinh]

I set the namespace in the my job parameters and I see it go out on the POST, but it is still not working. I get the same error as before which is that it could not find the macro. I'm wondering if the REST api is even looking at the namespace parameter.