search/jobs/sid/results

[justaj]

Hi,

I'm creating a search via search/jobs. I am then getting the status of the search via search/jobs/sid. Once I see a status of isDone = true then I call search/jobs/sid/results. Nothing is returned.

If I view the sid via the splunk gui I see results so I know it's getting properly created.
For the final get call I am sending: search/jobs/sid/results --get -d output_mode=json

Any suggestions?

[whrg]

Hello @justaj,

I cannot tell why your final call does not return anything.

However, depending on your use case, you could simplify the whole process. Instead of running multiple API calls (creating the search, querying whether the search has finished, fetching the results), you can also run just one API call. Check out this thread:

How to use the REST API to just run a search and stream the results back?

[justaj]

I found that post a few days ago but it would most likely have the same issue. They are also including the index as a search parameter. I'll try it but it's most likely not going to work

[whrg]

Perhaps it has to do with permissions on knowledge objects such as field extractions, macros, etc. Are you specifying a specific namespace?

If not, specify a namespace like this:

https://yoursplunkserver:8089/servicesNS/YOUR_USERNAME/YOURAPP/search/jobs/.

If you call the API without specifying a namespace, then I believe all knowledge objects must be shared globally.

[justaj]

I just figured out it was a permissions issue. I found this article: https://answers.splunk.com/answers/389557/why-is-our-custom-admin-role-unable-to-search-inte.html

and it turns out the account hadn't been granted rights to everything. Thanks everyone

[justaj]

I found that the issue was specific to a search parameter I had added. For whatever reason when I include 'index' as part of my search no results are returned via curl. I have different environments so I have to pass in 'index=develop'. The same thing works in the Splunk GUI however. If i remove it I get results however I get far too many without the filter.

I did try adding --data-urlencode prior to 'search' but that didn't return any results either

[harsmarvania57]

Hi,

Have you tried with curl ? Like curl -vk -u <user>:<password> https://<SPLUNKSERVER>:<SPLUNK_MGMT_PORT>/services/search/jobs/<SID>/results?output_mode=json