Splunk Search

How to get big data with Splunk with Rest API without using Splunk Java SDK

duddukuri
Explorer

By using the below implementation, able to query the Splunk with Rest API without using Splunk Java SDK

String uri = "https://:8089/services/search/jobs/export?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

import org.springframework.http.ResponseEntity;
import org.springframework.http.client.support.BasicAuthenticationInterceptor;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.util.UriComponentsBuilder;

public class RestSplunkClient{
public String get(String uri, String username, String password) {
RestTemplate restTemplate = new RestTemplate();
if(null!=username && null!=password && !username.isEmpty() && !password.isEmpty()) {
restTemplate.getInterceptors().add(new BasicAuthenticationInterceptor(username, password));
}
UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(uri);
ResponseEntity response =restTemplate.getForEntity(builder.build().toUriString(), String.class); return response.getBody(); } }

The above Implementation works fine for events count upto 10000.
I want to retrive the data with paging concept, when i tried with create of search job, it is not working.
String uri = "https://:8089/services/search/jobs?search=search ID=d19b7c20-22e2-4832-883e-8df3907fedc0";

Kindly advice me in this regard.

Thanks a lot in advance...

0 Karma

duddukuri
Explorer

This is with Curl, curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search *"
how about with Restcall??
i tried the below, but no luck...

https://localhost:8089/services/search/jobs/search="search *"
https://localhost:8089/services/search/jobs?search="search *"

0 Karma

duddukuri
Explorer

i want to create the search job and then want to retrive the data with pagging/offset concept
String uri = "https://*:8089/services/search/jobs//results?output_mode=raw&count=0&offset=0*";

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...