Splunk Search

Splunk REST API

revanthammineni
Path Finder

Hi Splunkers!!

I'm working with a team where they have to access to one of the saved  search results through Splunk API. The search results are more than 10k and API call returning only few results. I've checked limits.conf and it's good(limit is 50k). Any recommendations  in solving this issue. TIA.

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

It is a working sample. Maybe something causing an error on your search string. are you using double quotes for your savedsearch name? If yes please try below,. You can also test with output mode csv,

curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search='savedsearch abc' -d output_mode=csv

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @revanthammineni,

Please try below with only one call;

curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search="savedsearch abc" -d output_mode=json
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

revanthammineni
Path Finder

Thank you.
I tried but I'm getting an error. Text: not found

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @revanthammineni,

Did you try with export endpoint? I am sharing a sample;

 curl -k -H "Authorization: Bearer **Token***" https://SPLUNK_URL:8089/services/search/jobs/export --data-urlencode search='search index="my-index" earliest=-1d latest=now | table field1, field2' -d output_mode=json

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

revanthammineni
Path Finder

Hi. Thanks for the reply. I'm basically doing two calls. One is to get the SID and another one for the results.

 

1) curl -u user:password https://splunk_server:8089/services/search/jobs -d "search=savedsearch abc"  (Runs the saved search and Gives the SID)

2) curl -u user:password https:// splunk_server:8089/services/search/jobs/1617249001.81614/results (Gives the results)

These are the curl scripts I've been using. But they're not retrieving the full results.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What query is the team using?  How many is "a few"?  Have they tried repeating the API call to get more results?

---
If this reply helps you, Karma would be appreciated.

revanthammineni
Path Finder

It's the saved search I created to pull the overall host information. They are trying to access the results via API. Out of 16k results, I could only see that API returning 3k results. I tried to multiple calls, But SID is expiring after few calls.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...