Splunk Search

How to use REX in a search called via REST API?

Stuartb_
New Member

In my first post,

I need to search Splunk using the REST API. How do I get the system to actually return me some results?

Steps

  1. POST a search, example: 

 

 

search=search index=myIndex earliest=-1d "[nice-keyword]" AND "Nice catch-phrase" | rex field=_raw "reportingSystem\":\s+\"(?<system>\d{3})[\s\S]+operationCode\":\s+\"(?<opcode>\w+)[\s\S]+ticketId\":\s+\"(?<ticket>\d*)[\s\S]+transactionCode\":\s+\"(?<txcode>\w+)[\s\S]+NumericCode\":\s+\"(?<agency>\d*)" | table system, opcode, txcode, agency​

 

 

  • In the SEARCH User Interface, this makes a nice report
  • Grab the job search ID.
  • Continually GET the job status of the POSTed search until DONE or something else that helps me stop polling.
  • Ask for the job results. Get 200 OK but no content.

How does one actually format a search that can provide actual results via the API?

Stumped. For days. I'm using Postman before moving on to my favorite middleware tool.

Thank you.

Labels (2)
0 Karma

Stuartb_
New Member

Having found that url encoding works well (thanks to other posters), I have made some progress! Next to work out how to find the eventId and to be able to do a JOIN in the same search via API.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...