About john_dem8

john_dem8 · ‎06-26-2022

@jamie00171 I tried to search _audit index but didn't get any results for SID I used with SDK or for one I used directly in Splunk. I ran this: | loadjob <search Id> and was not able to see any data for SID using SDK. I also tried this: https://base_url.com/en-US/manager/search/job_inspector?sid=<search ID> and it said: "This search has completed in 0.98 seconds but did not match any events. The terms specified in the highlighted portion of the search: <my query here>...." I ran that query in Splunk and it returned some events. So I am still not sure what can be wrong with SDK.

john_dem8 · ‎06-25-2022

@PickleRick I just tried to run same query with SDK and in Splunk and I didn't get results with SDK. Here is the response: {"preview":false, "post_process_count":0, "mesages":[], "results":[], "init_offset":0} I also noticed, the field I used in my query is not a default field in Splunk, it's under "Interesting fields" category. I just created a job with SDK, copied the SID value and pasted it in Splunk URL: https://base_url.com/?sid=... but that was redirected to another SID and it displayed results in Splunk. @PickleRick Is that what you meant to do for troubleshooting?

john_dem8 · ‎06-25-2022

@PickleRick Yeah, I use the same username.

john_dem8 · ‎06-25-2022

Does anybody know why while I am able to get results when running query with any field in Splunk, I am getting empty result when trying to run the same query for particular fields with Java SDK? Does that mean some fields are special somehow? Sample query: search field1=value1 Java code: JobArgs jobArgs=new JobArgs(); jobArgs.setEarliest("-1m@m"); String query="search field1=value1"; Job job=splunkService.getJobs().create(query, jobArgs); while(!job.isDone()) { Thread.sleep(500); } JobResultsArgs resultsArgs=new JobResultsArgs(); resultsArgs.setOutPutMode(JSON); job.getResults(resultsArgs);

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-25-2022

Online Status	Offline
Date Last Visited	‎06-26-2022 03:15 PM

Getting empty results when running search with par...

Re: Getting empty results when running search with...

Re: Getting empty results when running search with...

Re: Getting empty results when running search with...

Getting empty results when running search with par...