Splunk Search
Highlighted

How to run Splunk searches in a custom REST endpoint?

Communicator

I have implemented a custom rest end point and it's working. Now I have another requirement to run Splunk searches in the same rest end point, so I would like to know the best practice for it.

I've tried calling search/jobs rest point, but I do not see actual search results

0 Karma
Highlighted

Re: How to run Splunk searches in a custom REST endpoint?

Influencer

When you POST to /services/search/jobs, the response from the splunk server should be a search id (sid). You will then need to do a GET request to /services/search/jobs//results to get the results from splunk (when they are ready)

Alternatively you can use the /services/search/jobs/export endpoint. This will stream the results back to you.

0 Karma
Highlighted

Re: How to run Splunk searches in a custom REST endpoint?

Communicator

I've already tried singleshot search to services/search/jobs end point with splunk.rest.simpleRequest() but I did not receive results. No luck with /services/search/jobs/export endpoint too.

0 Karma
Highlighted

Re: How to run Splunk searches in a custom REST endpoint?

Communicator

I've tried singleshot search to services/search/jobs end point with python requests and it works.

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.