Splunk Search

Creating a search job.

Communicator

To create a search job one has to

1.use the REST endpoint '/services/search/jobs'.
2.Use the POST method and include the session key as 'Authorization' in the header
3.Provide the search string in the request body.
4.A search ID will be returned as a Response.

Am i right to say these steps are necessary to create a search job?

And so does these steps apply to Java Splunk APIs?

0 Karma

Ultra Champion

The Java SDK is a programming interface that abstracts the underlying REST API.
So, steps 1-4 are correct , and if you use the Java SDK these will be handled for you.

Service service = new Service("myhost",8089);
service.login("user","pass"); //gets the session key, subsequent operations use this in the Authorization header
Job job = service.getJobs().create("search * |  head 10"); //POST search string to /search/jobs
String searchID = job.getSid();//get search ID
0 Karma