Splunk Search

How to get all fields of event with 'sid' via REST endpoint ?

shravankumarkus
New Member

/servicesNS/nobody/search/search/jobs/sid/results -- this endpoint is not giving all fields of events for the searchid and even in dashboard when i view results of triggered alert its returning the results in 'fast mode', so some fields are missing.

how to get all field of eventss via REST api with <sid> ?

Tags (1)
0 Karma

niketn
Legend

@shravankumarkusuma you have misunderstood the usage for /search/jobs/<sid>/results endpoint. Refer to documentation as to how this can be used. Using curl you can provide the list of fields for search and get the result. Just the rest api call using rest command in Splunk will not return anything as stated in the documentation: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id....

For your usecase try loadjob command instead.

| loadjob <sid> events=false
| analyzefields classfield=is_activated
| fields field
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...