Splunk Search

Why is | rest command not returning any data where CURL works?

eregon
Path Finder

Good morning fellow Splunkthiasts!

I am trying to build some dashboard using Splunk REST, unfortunately I can not get the data from certain endpoints when using | rest SPL command, while CURL approach returns what is expected.

To be specific, I want to read /services/search/jobs/<SID>/summary endpoint. Following SPL returns 0 results:

 

 

 

| rest /services/search/jobs/1648543133.8/summary

 

 

 

When called externally, the endpoint works as expected:

 

 

 

[2022-03-29 10:46:25] root@splunk1.lab2.local:~# curl -k -u admin:pass https://localhost:8089/services/search/jobs/1648543133.8/summary --get | head
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 15578  100 15578    0     0   661k      0 --:--:-- --:--:-- --:--:--  661k
<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_bkt</field>
<field>_cd</field>
<field>_eventtype_color</field>
<field>_indextime</field>
<field>_kv</field>
<field>_raw</field>

 

 

 

 The same happens with /services/search/jobs/<SID>/results and /services/search/jobs/<SID>/events.

When I call /services/search/jobs/ or /services/search/jobs/<SID>, data is returned by both SPL and CURL. I tried this on several Splunk instances with versions ranging from 8.2.3 back to 7.3.3, always using account with admin role - the behavior is always exactly the same.

Any hints what I might be missing?

Labels (2)
Tags (3)
0 Karma

VatsalJagani
Champion

@eregon , @MKozanic - These endpoints that you mentioned definitely don't work with SPL command, I can confirm that.

Now, this could be a bug or intentionally not implemented stuff. I'm not sure. But you can do some of these with other SPL functionalities. 

Like, you could fetch the results with loadjob command.

| loadjob 1655385534.107304

 

I would suggest you to change your direction of search. Whatever data you want try to see if there is a separate SPL command to get it.

References:

 

I hope this helps!!!

0 Karma

MKozanic
Path Finder

@eregon , 

Did you figure this one out?  I'm having the same issue with one of the instances I look after.

Can curl OK - but get nothing when trying to run | rest command from SPL.

Have not seen this issue before - haven't been able to determine the cause as yet.

0 Karma

eregon
Path Finder

Hi @MKozanic , unfortunately not yet. I got some hints from Splunk expert at .conf, so I'll try and see.

However, you mention you have this issue on one of your instances - does that mean you have some instances where | rest works as expected?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...