Splunk Search

How to get big data with Splunk with Rest API without using Splunk Java SDK

duddukuri
Explorer

By using the below implementation, able to query the Splunk with Rest API without using Splunk Java SDK

String uri = "https://:8089/services/search/jobs/export?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

import org.springframework.http.ResponseEntity;
import org.springframework.http.client.support.BasicAuthenticationInterceptor;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.util.UriComponentsBuilder;

public class RestSplunkClient{
public String get(String uri, String username, String password) {
RestTemplate restTemplate = new RestTemplate();
if(null!=username && null!=password && !username.isEmpty() && !password.isEmpty()) {
restTemplate.getInterceptors().add(new BasicAuthenticationInterceptor(username, password));
}
UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(uri);
ResponseEntity response =restTemplate.getForEntity(builder.build().toUriString(), String.class); return response.getBody(); } }

The above Implementation works fine for events count upto 10000.
I want to retrive the data with paging concept, when i tried with create of search job, it is not working.
String uri = "https://:8089/services/search/jobs?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

Kindly advice me in this regard.

Thanks a lot in advance...

0 Karma

duddukuri
Explorer

This is with Curl, curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search *"
how about with Restcall??
i tried the below, but no luck...

https://localhost:8089/services/search/jobs/search="search *"
https://localhost:8089/services/search/jobs?search="search *"

0 Karma

duddukuri
Explorer

i want to create the search job and then want to retrive the data with pagging/offset concept
String uri = "https://*:8089/services/search/jobs//results?output_mode=raw&count=0&offset=0*";

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...