Splunk Search

How to get big data with Splunk with Rest API without using Splunk Java SDK

duddukuri
Explorer

By using the below implementation, able to query the Splunk with Rest API without using Splunk Java SDK

String uri = "https://:8089/services/search/jobs/export?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

import org.springframework.http.ResponseEntity;
import org.springframework.http.client.support.BasicAuthenticationInterceptor;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.util.UriComponentsBuilder;

public class RestSplunkClient{
public String get(String uri, String username, String password) {
RestTemplate restTemplate = new RestTemplate();
if(null!=username && null!=password && !username.isEmpty() && !password.isEmpty()) {
restTemplate.getInterceptors().add(new BasicAuthenticationInterceptor(username, password));
}
UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(uri);
ResponseEntity response =restTemplate.getForEntity(builder.build().toUriString(), String.class); return response.getBody(); } }

The above Implementation works fine for events count upto 10000.
I want to retrive the data with paging concept, when i tried with create of search job, it is not working.
String uri = "https://:8089/services/search/jobs?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

Kindly advice me in this regard.

Thanks a lot in advance...

0 Karma

duddukuri
Explorer

This is with Curl, curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search *"
how about with Restcall??
i tried the below, but no luck...

https://localhost:8089/services/search/jobs/search="search *"
https://localhost:8089/services/search/jobs?search="search *"

0 Karma

duddukuri
Explorer

i want to create the search job and then want to retrive the data with pagging/offset concept
String uri = "https://*:8089/services/search/jobs//results?output_mode=raw&count=0&offset=0*";

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...