Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Where is the Splunk API documentation for search jobs?

sboogaar
Path Finder
‎08-03-2022 04:21 AM

In an online example that lets you export a splunk result, I found the following code.

 

<a class="btn btn-primary" role="button" href="/api/search/jobs/$export_sid$/results?isDownload=true&amp;timeFormat=%25FT%25T.%25Q%25%3Az&amp;maxLines=0&amp;count=0&amp;filename=$filename_token$&amp;outputMode=csv">Download CSV</a> 

This does almost exactly what I want, so I tried to find more information of what is happening.

I see some parameters there and I want to understand them.

  • isDownload=true&amp;
  • timeFormat=%25FT%25T.%25Q%25%3Az&amp;
  • maxLines=0&amp;count=0&amp;
  • filename=$filename_token$&amp;
  • outputMode=csv

I think the fields are almost self explaining but I would like to read the official documentation, also I would like the know what other possible parameters I can provide.

When looking for the documentation I only found : Search endpoint descriptions - Splunk Documentation

But this does not describe the parameters passed in the example. Where can i find an explenation of the parameters used? 

0 Karma
Reply
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...