Splunk Search

Run makeresults command through REST API is giving error

denissotoacc
Path Finder

I receive the following error while trying to execute a simple "makeresults" command by using REST API call:

Used endpoint:
https://localhost:8089/servicesNS/nobody/myapp/search/jobs

Search example:

"| makeresults | eval name=\"denis\""


Error message:
"Error in 'makeresults' command: This command must be the first command of a search."

"search": "search | makeresults | eval nombre=\"denis\""

I see that the API call changes my search adding a "search" word before the search itself. How can I get riddle of that?

Labels (1)
0 Karma

Nadhem9
New Member

Try using this uri: https://<host>:<mPort>/services/search/v2/jobs/

The api uri that you are using is depricated.
To my knowledge, it deletes the "|" in the beginning of the SPL query, that's why you got the error "Error in 'makeresults' command: This command must be the first command of a search.". 

What splunk receives from your query "search | makeresults | eval nombre=\"denis\"" with api call is this:
makeresults | eval nombre="denis"

AND NOT

| makeresults | eval nombre="denis"

https://docs.splunk.com/Documentation/Splunk/9.2.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch...

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

This should work

[soutamo@vega] ~>
(0) $ curl -ku $PASS https://localhost:8089/servicesNS/-/search/search/jobs -d search=" |makeresults|eval name=\"denis\""
<?xml version="1.0" encoding="UTF-8"?>
<response>
  <sid>1688721961.24</sid>
</response>
[soutamo@vega] ~>
(0) $ export SID=1688721961.24 &&  curl -sku $PASS https://localhost:8089/services/search/jobs/$SID/results?output_mode=json|jq '.results'
[
  {
    "_time": "2023-07-07T12:26:02.000+03:00",
    "name": "denis"
  }
]
[soutamo@vega] ~>
(0) $

r. Ismo 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@denissotoacc 

Can you please share your sample code?

KV

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...