Splunk Search

How to get all fields of event with 'sid' via REST endpoint ?

shravankumarkus
New Member

/servicesNS/nobody/search/search/jobs/sid/results -- this endpoint is not giving all fields of events for the searchid and even in dashboard when i view results of triggered alert its returning the results in 'fast mode', so some fields are missing.

how to get all field of eventss via REST api with <sid> ?

Tags (1)
0 Karma

@shravankumarkusuma you have misunderstood the usage for /search/jobs/<sid>/results endpoint. Refer to documentation as to how this can be used. Using curl you can provide the list of fields for search and get the result. Just the rest api call using rest command in Splunk will not return anything as stated in the documentation: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id....

For your usecase try loadjob command instead.

| loadjob <sid> events=false
| analyzefields classfield=is_activated
| fields field
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...