Hi guys,
I have a Splunk scheduled search which is producing a list of URLs that need to be used by another system. The other system has to access the list using http/https protocol.
Now, what i'm looking for is:
Can someone guide me in how to achieve this?
Thanks in advance!
Andrei
@raduand, Splunk search results can be pushed to lookup file using outputlookup
. (Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup)
Within Splunk you can read csv file using inpulookup
command. ( Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup)
You can create report with inputlookup command to list the contents of the csv file and the pull the Report results using REST API search/jobs/{search_id}/results
. Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...
search="| inputlookup lookupname.csv"
@raduand, Splunk search results can be pushed to lookup file using outputlookup
. (Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup)
Within Splunk you can read csv file using inpulookup
command. ( Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/inputlookup)
You can create report with inputlookup command to list the contents of the csv file and the pull the Report results using REST API search/jobs/{search_id}/results
. Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...
This is great, but is there any way of finding the "search_id" of a scheduled search? I've tried using the search_id that is listed in the URL when opening the search in the GUI and the search_is that is listed on the enpoint https://<host>:<mPort>/services/search/jobs (which I found to be not the same for some reason), but I always get the result "Unknown endpoint".
Anyone know how to find the correct ID for a scheduled search?