I'm working with a team where they have to access to one of the saved search results through Splunk API. The search results are more than 10k and API call returning only few results. I've checked limits.conf and it's good(limit is 50k). Any recommendations in solving this issue. TIA.
It is a working sample. Maybe something causing an error on your search string. are you using double quotes for your savedsearch name? If yes please try below,. You can also test with output mode csv,
curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search='savedsearch abc' -d output_mode=csv
Please try below with only one call;
curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search="savedsearch abc" -d output_mode=json
Did you try with export endpoint? I am sharing a sample;
curl -k -H "Authorization: Bearer **Token***" https://SPLUNK_URL:8089/services/search/jobs/export --data-urlencode search='search index="my-index" earliest=-1d latest=now | table field1, field2' -d output_mode=json
Hi. Thanks for the reply. I'm basically doing two calls. One is to get the SID and another one for the results.
1) curl -u user:password https://splunk_server:8089/services/search/jobs -d "search=savedsearch abc" (Runs the saved search and Gives the SID)
2) curl -u user:password https:// splunk_server:8089/services/search/jobs/1617249001.81614/results (Gives the results)
These are the curl scripts I've been using. But they're not retrieving the full results.
It's the saved search I created to pull the overall host information. They are trying to access the results via API. Out of 16k results, I could only see that API returning 3k results. I tried to multiple calls, But SID is expiring after few calls.