Splunk Search

How to run Splunk searches in a custom REST endpoint?

i2sheri
Communicator

I have implemented a custom rest end point and it's working. Now I have another requirement to run Splunk searches in the same rest end point, so I would like to know the best practice for it.

I've tried calling search/jobs rest point, but I do not see actual search results

0 Karma
1 Solution

i2sheri
Communicator

I've tried singleshot search to services/search/jobs end point with python requests and it works.

View solution in original post

0 Karma

i2sheri
Communicator

I've tried singleshot search to services/search/jobs end point with python requests and it works.

View solution in original post

0 Karma

jplumsdaine22
Influencer

When you POST to /services/search/jobs, the response from the splunk server should be a search id (sid). You will then need to do a GET request to /services/search/jobs//results to get the results from splunk (when they are ready)

Alternatively you can use the /services/search/jobs/export endpoint. This will stream the results back to you.

0 Karma

i2sheri
Communicator

I've already tried singleshot search to services/search/jobs end point with splunk.rest.simpleRequest() but I did not receive results. No luck with /services/search/jobs/export endpoint too.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!