Why am I unable to get Splunk Search query in Ansible Playbook (everything works with curl)?

[kumarvarun1252]

Currently we manually monitor splunk dashboards during our deploys. We would like to automate this. For this, we would like to come up with an ansible playbook with the splunk queries. This playbook will be run during deployment.

I am successfully able to make connection to splunk, but I am not able to get the search query working

####
# type: task
#
# vars:
# 5xxcheck_output(str,command): raw output from command
# 5xxcheck_response(str,command): raw output to json
#
# desc:
# uses splunk to get 5xxcheck

---
- name: Tasks to query splunk
hosts: localhost
connection: local
tasks:
- name: get search_id for 5xx check from splunk
uri:
url: https://<splunk_instance>/services/search/jobs
follow_redirects: all
method: POST
user: xxxxxx
password: xxxxxxx
force_basic_auth: yes
body: "search host=tc1* ResponseCode=500 earliest=-15m"
body_format: raw
validate_certs: no
status_code: 201
return_content: true
register: search_id
- debug: msg="{{ search_id.status }}"

- name: use the search_id to get the 5xx check results
uri:
url: https://<splunk_instance>/services/search/jobs/{{ search_id }}/results/
method: GET
user: xxxxxx
password: xxxxxxx
force_basic_auth: yes
body_format: raw
return_content: true
register: 5xxcheck_output
until: 5xxcheck_output.status > 0 and 5xxcheck_output.status != 500

- name: Put results into 5xxcheck_response
set_fact:
5xxcheck_response: "{{ 5xxcheck_output.json }}"

- name: Print 5xxcheck_response if -v
debug:
var: 5xxcheck_response
verbosity: 1

I would like to use uri module to parameterize the splunk search. I am able to execute the following 2 steps from terminal, to get the response

Step1: Get the SID(Search ID)

curl -u user:pwd -k https://<splunk-instance>/services/search/jobs -d search="search host=t1* ResponseCode=200 earliest=-15m"

<?xml version="1.0" encoding="UTF-8"?>
<response>
<sid>1604947864.xxxxxx</sid>
</response>

Step2: Use the SID to get the response

curl -u user:pwd -k https://<splunk-instance>/services/search/jobs/<SID>/results/ --get -d output_mode=raw

[koshyk]

I understand this is quite old, but please have a try like below..

- name: "SEARCH: Run Search and register Sid"
  uri:
    url: "{{splunk_ssl_uri}}:{{splunk.port.mgmt}}/services/search/jobs"
    method: POST
    user: xxxx
    password: xxxx
    body: 
      - [ search, "{{splunk_search}}"]
    status_code: [200, 201]
    force_basic_auth: yes
    validate_certs: no
    body_format: form-urlencoded
    return_content: true
  vars:
    - splunk_search: "search index=_internal | stats count"
  register: splunk_search_register