Run makeresults command through REST API is giving error

[denissotoacc]

I receive the following error while trying to execute a simple "makeresults" command by using REST API call:

Used endpoint:
https://localhost:8089/servicesNS/nobody/myapp/search/jobs

Search example:

"| makeresults | eval name=\"denis\""

Error message:
"Error in 'makeresults' command: This command must be the first command of a search."

"search": "search | makeresults | eval nombre=\"denis\""

I see that the API call changes my search adding a "search" word before the search itself. How can I get riddle of that?

[Nadhem9]

Try using this uri: https://<host>:<mPort>/services/search/v2/jobs/

The api uri that you are using is depricated.
To my knowledge, it deletes the "|" in the beginning of the SPL query, that's why you got the error "Error in 'makeresults' command: This command must be the first command of a search.". 

What splunk receives from your query "search | makeresults | eval nombre=\"denis\"" with api call is this:
makeresults | eval nombre="denis"

AND NOT

| makeresults | eval nombre="denis"

https://docs.splunk.com/Documentation/Splunk/9.2.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch...

[isoutamo]

Hi

This should work

[soutamo@vega] ~>
(0) $ curl -ku $PASS https://localhost:8089/servicesNS/-/search/search/jobs -d search=" |makeresults|eval name=\"denis\""
<?xml version="1.0" encoding="UTF-8"?>
<response>
  <sid>1688721961.24</sid>
</response>
[soutamo@vega] ~>
(0) $ export SID=1688721961.24 &&  curl -sku $PASS https://localhost:8089/services/search/jobs/$SID/results?output_mode=json|jq '.results'
[
  {
    "_time": "2023-07-07T12:26:02.000+03:00",
    "name": "denis"
  }
]
[soutamo@vega] ~>
(0) $

r. Ismo 

[kamlesh_vaghela]

@denissotoacc 

Can you please share your sample code?

KV