Extending Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 382

<id>https://localhost:8089/services/search/jobs/1352061658.136</id>
...
<link href="/services/search/jobs/1352061658.136/events"
rel="events"/>
<link href="/services/search/jobs/1352061658.136/results"
rel="results"/>
...
<content type="text/xml">
<s:dict>
...
<s:key name="doneProgress">1.00000</s:key>
...
<s:key name="eventCount">67</s:key>
...
<s:key name="isDone">1</s:key>
...
<s:key name="resultCount">1</s:key>
Interesting fields include doneProgress , eventCount , resultCount , and the field
we are most interested in at this point, isDone . If isDone is not 1 , we should wait
and poll again later. Once isDone=1 , we can retrieve our results from the URL
specified in <link rel="results"> .
To retrieve our results, we call the following:
curl -u admin:changeme -k https://localhost:8089/services/search/
jobs/1352061658.136/results
This returns the following XML output:
<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>host</field>
<field>count</field>
</fieldOrder>
</meta>
<result offset='0'>
<field k='host'>
<value><text>vlb.local</text></value>
</field>
<field k='count'>
<value><text>67</text></value>
</field>
</result>
</results>