Could anyone spot why the code is failing to create a search with HTTP POST?

[ChintanaM]

Dear all,

I am trying to initiate a search using Splunk cloud rest API. Using following code

const accessToken = "--my-super-secret-token--";
const url = "https://company-installation.splunkcloud.com:8089/services/search/jobs";

try {
  const authHeaderValue = `Splunk ${accessToken}`;

  const config = {
    headers: {
      'Authorization': authHeaderValue
    },
    params: {
      'output_mode': 'json',
      'search':'search *'
    }
  };

  const res = await axios.post(url, config);

  return {
    statusCode: 200,
    body: JSON.stringify(res.data),
  };
  
} catch (e) {


  return {
    statusCode: 400,
    body: JSON.stringify(e),
  };
}

When the code is executed I get a 401 at line const res = await axios.post(url, config);

My api token is valid and my IP address is whitelisted

When axios.post is replaced with axios.get, I get list of searches back which also verifies token and IP address are good

Could anyone spot why the code is failing to create a search with HTTP POST please?

I am very new to Splunk REST API and any help is much appreciated

[arsen_ye]

Hi @ChintanaM, 

I'm also new to splunk and I faced to a problem, maybe you can help me. Does you search param works fine? I'm also trying to search with axios post request but I'm getting 26mb of data. It seems that my search parameter doesn't work and my request return all the data that exists.   

Thanks in advance.

[ChintanaM · Accepted solution]

Hi all,

The issue was on how axios was dealing with its payload. Just needed to encode data for to be able to calculate content-length.

Cheers

CM

[Pat]

Could you expand on this with what you had changed?  I have no idea what you meant by encode data.