Splunk Search

Why is | rest command not returning any data where CURL works?

eregon
Path Finder

Good morning fellow Splunkthiasts!

I am trying to build some dashboard using Splunk REST, unfortunately I can not get the data from certain endpoints when using | rest SPL command, while CURL approach returns what is expected.

To be specific, I want to read /services/search/jobs/<SID>/summary endpoint. Following SPL returns 0 results:

 

 

 

| rest /services/search/jobs/1648543133.8/summary

 

 

 

When called externally, the endpoint works as expected:

 

 

 

[2022-03-29 10:46:25] root@splunk1.lab2.local:~# curl -k -u admin:pass https://localhost:8089/services/search/jobs/1648543133.8/summary --get | head
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 15578  100 15578    0     0   661k      0 --:--:-- --:--:-- --:--:--  661k
<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_bkt</field>
<field>_cd</field>
<field>_eventtype_color</field>
<field>_indextime</field>
<field>_kv</field>
<field>_raw</field>

 

 

 

 The same happens with /services/search/jobs/<SID>/results and /services/search/jobs/<SID>/events.

When I call /services/search/jobs/ or /services/search/jobs/<SID>, data is returned by both SPL and CURL. I tried this on several Splunk instances with versions ranging from 8.2.3 back to 7.3.3, always using account with admin role - the behavior is always exactly the same.

Any hints what I might be missing?

Labels (2)
Tags (3)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@eregon , @MKozanic - These endpoints that you mentioned definitely don't work with SPL command, I can confirm that.

Now, this could be a bug or intentionally not implemented stuff. I'm not sure. But you can do some of these with other SPL functionalities. 

Like, you could fetch the results with loadjob command.

| loadjob 1655385534.107304

 

I would suggest you to change your direction of search. Whatever data you want try to see if there is a separate SPL command to get it.

References:

 

I hope this helps!!!

0 Karma

MKozanic
Path Finder

@eregon , 

Did you figure this one out?  I'm having the same issue with one of the instances I look after.

Can curl OK - but get nothing when trying to run | rest command from SPL.

Have not seen this issue before - haven't been able to determine the cause as yet.

0 Karma

eregon
Path Finder

Hi @MKozanic , unfortunately not yet. I got some hints from Splunk expert at .conf, so I'll try and see.

However, you mention you have this issue on one of your instances - does that mean you have some instances where | rest works as expected?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...