Splunk Search

Why am I receiving this Error while using the |rest in the splunk rest API?

smaran06
Path Finder

Hi Team,

I am trying to run a search and get the searchId, I will use this searchId later to fetch the results.

 

 

 

curl --location --request POST 'https://splunkcloud.com:<port>/services/search/jobs?output_mode=json' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer JWT' \
--data-raw 'search=search |rest /servicesNS/-/-/saved/searches/ splunk_server=local | rename eai:* as * | rename acl.* as *|search app=*| table triggered_alert_count, title

 

 

 

I am getting the SID and  doing get

 

 

 

https://splunkcloud.com:<port>/services/search/jobs/<SID>/results?output_mode=json

 

 

 

 I am getting the error as below

 

 

 

{
    "messages": [
        {
            "type": "FATAL",
            "text": "Error in 'rest' command: This command must be the first command of a search."
        }
    ]
}

 

 

 

 

 This works fine for normal searches, but not for searches thats starts with |rest. Let me know why rest is not taking | even after adding it.

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What are you trying to do? Use a REST call to create a | rest search? Kinda pointless. Why don't you call the proper  REST endpoint directly?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this should work

curl -ku <user:pass> https://localhost:8089/services/search/jobs/ -d search="|rest /servicesNS/-/-/saved/searches/ splunk_server=local | rename eai:* as * | rename acl.* as *|search app=*| table triggered_alert_count, title"
curl -ku <user:pass> https://localhost:8089/servicesNS/admin/search/search/jobs/1650521075.4791/results/ --get -d output_mode=json

Just switch user, pass and localhost to the correct values. If/when there is official TLS cert in place, then you don't need -k on curl.

r. Ismo 

0 Karma

renjith_nair
Legend

Try the search without the "search" keyword.

ie.

'search=|rest /servicesNS/-/-/saved/searches/ splunk_server=local ...
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...