Splunk Search

Splunk REST API

revanthammineni
Path Finder

Hi Splunkers!!

I'm working with a team where they have to access to one of the saved  search results through Splunk API. The search results are more than 10k and API call returning only few results. I've checked limits.conf and it's good(limit is 50k). Any recommendations  in solving this issue. TIA.

Labels (1)
0 Karma

scelikok
Champion

It is a working sample. Maybe something causing an error on your search string. are you using double quotes for your savedsearch name? If yes please try below,. You can also test with output mode csv,

curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search='savedsearch abc' -d output_mode=csv

 

If this reply helps you an upvote is appreciated.
0 Karma

scelikok
Champion

Hi @revanthammineni,

Please try below with only one call;

curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search="savedsearch abc" -d output_mode=json
If this reply helps you an upvote is appreciated.
0 Karma

revanthammineni
Path Finder

Thank you.
I tried but I'm getting an error. Text: not found

0 Karma

scelikok
Champion

Hi @revanthammineni,

Did you try with export endpoint? I am sharing a sample;

 curl -k -H "Authorization: Bearer **Token***" https://SPLUNK_URL:8089/services/search/jobs/export --data-urlencode search='search index="my-index" earliest=-1d latest=now | table field1, field2' -d output_mode=json

 

If this reply helps you an upvote is appreciated.
0 Karma

revanthammineni
Path Finder

Hi. Thanks for the reply. I'm basically doing two calls. One is to get the SID and another one for the results.

 

1) curl -u user:password https://splunk_server:8089/services/search/jobs -d "search=savedsearch abc"  (Runs the saved search and Gives the SID)

2) curl -u user:password https:// splunk_server:8089/services/search/jobs/1617249001.81614/results (Gives the results)

These are the curl scripts I've been using. But they're not retrieving the full results.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What query is the team using?  How many is "a few"?  Have they tried repeating the API call to get more results?

---
If this reply helps you, an upvote would be appreciated.

revanthammineni
Path Finder

It's the saved search I created to pull the overall host information. They are trying to access the results via API. Out of 16k results, I could only see that API returning 3k results. I tried to multiple calls, But SID is expiring after few calls.

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on