Splunk Search

How to run Splunk searches in a custom REST endpoint?

i2sheri
Communicator

I have implemented a custom rest end point and it's working. Now I have another requirement to run Splunk searches in the same rest end point, so I would like to know the best practice for it.

I've tried calling search/jobs rest point, but I do not see actual search results

0 Karma
1 Solution

i2sheri
Communicator

I've tried singleshot search to services/search/jobs end point with python requests and it works.

View solution in original post

0 Karma

i2sheri
Communicator

I've tried singleshot search to services/search/jobs end point with python requests and it works.

0 Karma

jplumsdaine22
Influencer

When you POST to /services/search/jobs, the response from the splunk server should be a search id (sid). You will then need to do a GET request to /services/search/jobs//results to get the results from splunk (when they are ready)

Alternatively you can use the /services/search/jobs/export endpoint. This will stream the results back to you.

0 Karma

i2sheri
Communicator

I've already tried singleshot search to services/search/jobs end point with splunk.rest.simpleRequest() but I did not receive results. No luck with /services/search/jobs/export endpoint too.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...