Splunk Search

How to get big data with Splunk with Rest API without using Splunk Java SDK

duddukuri
Explorer

By using the below implementation, able to query the Splunk with Rest API without using Splunk Java SDK

String uri = "https://:8089/services/search/jobs/export?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

import org.springframework.http.ResponseEntity;
import org.springframework.http.client.support.BasicAuthenticationInterceptor;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.util.UriComponentsBuilder;

public class RestSplunkClient{
public String get(String uri, String username, String password) {
RestTemplate restTemplate = new RestTemplate();
if(null!=username && null!=password && !username.isEmpty() && !password.isEmpty()) {
restTemplate.getInterceptors().add(new BasicAuthenticationInterceptor(username, password));
}
UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(uri);
ResponseEntity response =restTemplate.getForEntity(builder.build().toUriString(), String.class); return response.getBody(); } }

The above Implementation works fine for events count upto 10000.
I want to retrive the data with paging concept, when i tried with create of search job, it is not working.
String uri = "https://:8089/services/search/jobs?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

Kindly advice me in this regard.

Thanks a lot in advance...

0 Karma

duddukuri
Explorer

This is with Curl, curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search *"
how about with Restcall??
i tried the below, but no luck...

https://localhost:8089/services/search/jobs/search="search *"
https://localhost:8089/services/search/jobs?search="search *"

0 Karma

duddukuri
Explorer

i want to create the search job and then want to retrive the data with pagging/offset concept
String uri = "https://*:8089/services/search/jobs//results?output_mode=raw&count=0&offset=0*";

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...