Splunk Search

My initial REST call to search returned debug information

teresa1688
Explorer

I have installed splunk on my pc (windows7) and start to play with REST web service calls to perform search. I can see search results in my online search page but not in the web service call. Any clue on what the issues may be? Thanks.

This is the command I use:
curl -k -u admin: https://localhost:8089/services/search/jobs/export -d output_mode=xml -d exec_mode=oneshot -d earliest_time=-60m -d latest_time=now -d search="search *"

The web service returned the following message:

<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
<messages>
  <msg type="DEBUG">Configuration initialization for C:\Program Files\Splunk\etc took 31ms when dispatching a search (search ID: 1489446839.10)</msg>
  <msg type="DEBUG">base lispy: [ AND ]</msg>
  <msg type="DEBUG">search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc"</msg>
</messages>

</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
Tags (3)
0 Karma
1 Solution

teresa1688
Explorer

The issue is with using SOAPUI to replicate a cURL command.

View solution in original post

0 Karma

teresa1688
Explorer

The issue is with using SOAPUI to replicate a cURL command.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@teresa1688 - Glad to find that you figured out the solution. Please don't forget to click "Accept" to close out your question. Thank you.

0 Karma

teresa1688
Explorer

Please close this question since the issue has been resolved. The issue was with using SOAPUI to replicate a curl command.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...