Splunk Dev

Splunk Java SDK: How do you query a macro defined in a custom app instead of the default splunk search app?

dinh
Path Finder

I have a custom app defined. I want to query a macro defined in it. The samples provided here (http://code.google.com/p/splunk-java-sdk/w/list) call splunk's search app by default. How do I get it to call my custom app instead?

Tags (2)
0 Karma
1 Solution

dinh
Path Finder

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

View solution in original post

psanford_splunk
Splunk Employee
Splunk Employee

We are currently building out a new Java SDK. It will be available on GitHub. I can give pre-release access - just need a GitHub ID.

Any questions - psanford@splunk.com or ping us on Twitter: @splunkdev

wcolgate_splunk
Splunk Employee
Splunk Employee

The Java SDK supports namespaces for exactly this reason.

0 Karma

dinh
Path Finder

It looks like this was answered in another post. The trick is to instead of sending it to the following path:

POST https://splunkserver.local:8089/services/search/jobs

Send it to

POST https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

wcolgate_splunk
Splunk Employee
Splunk Employee

While the URLs are correct, the Java SDK (which the OP refers to), supports namespaces. There is a description here: http://dev.splunk.com/view/SP-CAAAECN#namespaces

0 Karma

Johnvey
Contributor

If you are using the SDK from the current source, you can specify an optional namespace parameter when dispatching a job to target a specific app. See the inline docs here:

http://code.google.com/p/splunk-java-sdk/source/browse/trunk/SplunkSDK/src/com/splunk/sdk4x/search/J...

Note that the SDK is not considered stable for 4.0. Read more about Splunk's SDKs and APIs.

dinh
Path Finder

I set the namespace in the my job parameters and I see it go out on the POST, but it is still not working. I get the same error as before which is that it could not find the macro. I'm wondering if the REST api is even looking at the namespace parameter.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...