Splunk REST API

[revanthammineni]

Hi Splunkers!!

I'm working with a team where they have to access to one of the saved  search results through Splunk API. The search results are more than 10k and API call returning only few results. I've checked limits.conf and it's good(limit is 50k). Any recommendations  in solving this issue. TIA.

[scelikok]

It is a working sample. Maybe something causing an error on your search string. are you using double quotes for your savedsearch name? If yes please try below,. You can also test with output mode csv,

curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search='savedsearch abc' -d output_mode=csv

[scelikok]

Hi @revanthammineni,

Please try below with only one call;

curl -u user:password https://splunk_server:8089/services/search/jobs/export -d search="savedsearch abc" -d output_mode=json

[revanthammineni]

Thank you.
I tried but I'm getting an error. Text: not found

[scelikok]

Hi @revanthammineni,

Did you try with export endpoint? I am sharing a sample;

 curl -k -H "Authorization: Bearer **Token***" https://SPLUNK_URL:8089/services/search/jobs/export --data-urlencode search='search index="my-index" earliest=-1d latest=now | table field1, field2' -d output_mode=json

[revanthammineni]

Hi. Thanks for the reply. I'm basically doing two calls. One is to get the SID and another one for the results.

1) curl -u user:password https://splunk_server:8089/services/search/jobs -d "search=savedsearch abc"  (Runs the saved search and Gives the SID)

2) curl -u user:password https:// splunk_server:8089/services/search/jobs/1617249001.81614/results (Gives the results)

These are the curl scripts I've been using. But they're not retrieving the full results.

[richgalloway]

What query is the team using?  How many is "a few"?  Have they tried repeating the API call to get more results?

[revanthammineni]

It's the saved search I created to pull the overall host information. They are trying to access the results via API. Out of 16k results, I could only see that API returning 3k results. I tried to multiple calls, But SID is expiring after few calls.