Hi Everyone, we have another internal team that is trying to use the API to return some data we built for them. Unfortunately, they aren't able to get the payload but only the headers. Can someone suggest a solution or what we are doing wrong? the below is the response from the splunk API on their call.
Target: https://SomeHost:Port/servicesNS/user/search/search/jobs/export
Request body:
search=search inputlookup somefile.csv | table Day User emp_id Data
Response:
<results preview='0'>
<meta>
<fieldOrder>
<field>Day</field>
<field>User</field>
<field>emp_id</field>
<field>Data</field>
</fieldOrder>
</meta>
</results>
@PickleRick , thanks for leading us down the path. We actually had to append to get the data. What worked was the code below. Thank you for getting us there.
search=search NOT * | inputlookup somefile.csv append=true | table Day User emp_id Data
@PickleRick , thanks for leading us down the path. We actually had to append to get the data. What worked was the code below. Thank you for getting us there.
search=search NOT * | inputlookup somefile.csv append=true | table Day User emp_id Data
Thanks Rick. We will give this a shot and let you know the results. Appreciate you helping.
It's not entirely clear what you're trying to achieve.
The search
search=search inputlookup somefile.csv
will try to find events which contain literarily "inputtlookup" and "somefile.csv" strings in them (and of course field named search with value "search" but that's most probably a placeholder for some other part of a search).
So your initial search matches no results and the table command has no data to process so you only get column headers.
If you want the contents of a lookup, you need an inputlookup command on its own:
| inputlookup somefile.csv | table your set of fields
If you want the lookup to be applied to results of a search, just use lookup command
your search | lookup somefile.csv field | table [...]
If you want to append the results of the inputlookup command to the results of a search, just use inputlookup with append=true option
your search | inputlookup append=true somefile.csv | table [...]