Splunk Search
Highlighted

How to use the REST API to just run a search and stream the results back?

Champion

Hi,

I have a question about using the REST API to run a search. The doc seems to indicate that you need to follow 3 steps - create a search job, get the search status, and then get the search results. Is there any way to just run the search and stream the results back? Seems like a lot of steps...

Tags (4)
Highlighted

Re: How to use the REST API to just run a search and stream the results back?

Contributor

curl -ku username:password https://SearchHead_host:8089/servicesNS/admin/search/search/jobs/export -d search=“search index%3Dinternal | head 3” -d outputmode=csv/xml/json

View solution in original post

Highlighted

Re: How to use the REST API to just run a search and stream the results back?

Champion

Thanks! Works great.

0 Karma
Highlighted

Re: How to use the REST API to just run a search and stream the results back?

Path Finder

Does this require to have saved search query? Or you are making it on demand?

0 Karma
Highlighted

Re: How to use the REST API to just run a search and stream the results back?

Path Finder

the restful url call /serviceNS/admin/search/search/jobs/export is right?

0 Karma
Highlighted

Re: How to use the REST API to just run a search and stream the results back?

New Member

I wasn't able to get the above example to work. But, this one worked fine for me...

curl -k -u 'username:password' https://splunk.host.name.here:8089/services/search/jobs/export  -d search="search error | head 3" -d output_mode=xml

The main differences are...
1. I needed to quote my username and password (as they have special chars in them)
2. I needed to replace "servicesNS" with just "services"
3. Having "search" in the URL twice didn't work for me, I removed on of them.
4. Only one output_mode can be specified at a time (I put "xml" in my example, but the other two work, just not all at once)
5. I needed to remove the "smart quotes" and use normal quotes. That might just be my console being picky, though.

0 Karma
Highlighted

Re: How to use the REST API to just run a search and stream the results back?

Path Finder

I needed to add -d exec_mode=oneshot  otherwise it wouldn't stream the results back.

E.g.

curl -k -u 'username:password' https://splunk.host.name.here:8089/services/search/jobs/export  -d search="search index=_internal | head 3" -d output_mode=csv -d exec_mode=oneshot
0 Karma