Databases Reference
In-Depth Information
Querying Splunk via REST
Splunk provides an extensive HTTP REST interface, which allows searching,
adding data, adding inputs, managing users, and more. Documentation and
SDKs are provided by Splunk at
http://dev.splunk.com/
.
To get an idea of how this REST interaction happens, let's step through a sample
conversation to run a query and retrieve the results. The steps are essentially
as follows:
1.
Start the query (POST).
2.
Poll for status (GET).
3.
Retrieve results (GET).
We will use the command line program
cURL
to illustrate these steps. The SDKs
make this interaction much simpler.
To start a query, the command is as follows:
curl -u user:pass -k https://yourserver:8089/services/search/jobs
-d"search=search query"
This essentially says to POST
search=search query
. If you are familiar with HTTP,
you might notice that this is a standard POST from an HTML form.
To run the query
earliest=-1h index="_internal" warn | stats count by
host
, we need to URL encode the query. The command then is as follows:
$ curl -u admin:changeme -k https://localhost:8089/services/search/
jobs -d"search=search%20earliest%3D-1h%20index%3D%22_internal%22%20
warn%20%7C%20stats%20count%20by%20host"
If the query is accepted, we will receive XML that contains our search ID:
<?xml version='1.0' encoding='UTF-8'?>
<response><sid>1352061658.136</sid></response>
The contents of
<sid>
are then used to reference this job. To check the status of
our job, we run the following code:
curl -u admin:changeme -k https://localhost:8089/services/search/
jobs/1352061658.136
This returns a large document with copious amounts of information about our
job as follows:
<entry ...>
<title>search earliest=-1h index="_internal" warn | stats count by
host</title>
Search WWH ::
Custom Search