Splunk Search

Splunk rest api services/search/v2/jobs/export to search multiline command

gopal
New Member

Hi ,

i am trying to execute multiline splunk commands as below using rest endpoint

services/search/v2/jobs/export

 https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2Fexport

search command :

| inputlookup some_inputlokupfile.csv

| rename user as CUSTOMER,  zone as REGION, "product"  as PRODUCT_ID

| fields CUSTOMER*, PRODUCT_ID

| outputlookup some_example_generated_file.csv.gz override_if_empty=false

 

when i execute the curl it returns success 200 but file is not created.

is it possible to invoke multiline search command using pipe with this or any other search api?

the search is dynamic i cant create savedsearch and execute.

 

 

 

Tags (3)
0 Karma

marnall
Motivator

Are you able to generate the some_example_generated_file.csv.gz file from running the search in the Splunk webUI as the user whose credentials or token is being used to authorize the API request?

There should be no problem running searches with piped segments using curl and the search api endpoints. Though you may have to tweak the character encoding in the search query. I recommend trying it segment-by-segment to see if it generates the expected results.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could write “multi line” searches separated by | on one line. In normal situation there is no mater have you written SPL in one line or formatting it to several lines. It’s just for reading it easier.

You could also write your query as a report and then call it with savedsearch your report via rest.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...