Splunk Search

My initial REST call to search returned debug information

teresa1688
Explorer

I have installed splunk on my pc (windows7) and start to play with REST web service calls to perform search. I can see search results in my online search page but not in the web service call. Any clue on what the issues may be? Thanks.

This is the command I use:
curl -k -u admin: https://localhost:8089/services/search/jobs/export -d output_mode=xml -d exec_mode=oneshot -d earliest_time=-60m -d latest_time=now -d search="search *"

The web service returned the following message:

<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
<messages>
  <msg type="DEBUG">Configuration initialization for C:\Program Files\Splunk\etc took 31ms when dispatching a search (search ID: 1489446839.10)</msg>
  <msg type="DEBUG">base lispy: [ AND ]</msg>
  <msg type="DEBUG">search context: user="admin", app="search", bs-pathname="C:\Program Files\Splunk\etc"</msg>
</messages>

</results>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
Tags (3)
0 Karma
1 Solution

teresa1688
Explorer

The issue is with using SOAPUI to replicate a cURL command.

View solution in original post

0 Karma

teresa1688
Explorer

The issue is with using SOAPUI to replicate a cURL command.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@teresa1688 - Glad to find that you figured out the solution. Please don't forget to click "Accept" to close out your question. Thank you.

0 Karma

teresa1688
Explorer

Please close this question since the issue has been resolved. The issue was with using SOAPUI to replicate a curl command.

0 Karma
Get Updates on the Splunk Community!

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...