Good morning fellow Splunkthiasts!
I am trying to build some dashboard using Splunk REST, unfortunately I can not get the data from certain endpoints when using | rest SPL command, while CURL approach returns what is expected.
To be specific, I want to read /services/search/jobs/<SID>/summary endpoint. Following SPL returns 0 results:
| rest /services/search/jobs/1648543133.8/summary
When called externally, the endpoint works as expected:
[2022-03-29 10:46:25] email@example.com:~# curl -k -u admin:pass https://localhost:8089/services/search/jobs/1648543133.8/summary --get | head % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 15578 100 15578 0 0 661k 0 --:--:-- --:--:-- --:--:-- 661k <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder> <field>_bkt</field> <field>_cd</field> <field>_eventtype_color</field> <field>_indextime</field> <field>_kv</field> <field>_raw</field>
The same happens with /services/search/jobs/<SID>/results and /services/search/jobs/<SID>/events.
When I call /services/search/jobs/ or /services/search/jobs/<SID>, data is returned by both SPL and CURL. I tried this on several Splunk instances with versions ranging from 8.2.3 back to 7.3.3, always using account with admin role - the behavior is always exactly the same.
Any hints what I might be missing?
Now, this could be a bug or intentionally not implemented stuff. I'm not sure. But you can do some of these with other SPL functionalities.
Like, you could fetch the results with loadjob command.
| loadjob 1655385534.107304
I would suggest you to change your direction of search. Whatever data you want try to see if there is a separate SPL command to get it.
I hope this helps!!!
Did you figure this one out? I'm having the same issue with one of the instances I look after.
Can curl OK - but get nothing when trying to run | rest command from SPL.
Have not seen this issue before - haven't been able to determine the cause as yet.
Hi @MKozanic , unfortunately not yet. I got some hints from Splunk expert at .conf, so I'll try and see.
However, you mention you have this issue on one of your instances - does that mean you have some instances where | rest works as expected?