requesthttprequestsplunksplunk-querysplunk-sdk

Http get method for Splunk saved search using access token

What would be the correct HTTP get request call syntax to fetch saved search data from Splunk if we're accessing it through an access token?

My curl command is working but http.get is not.

curl command:

#os.system('curl -H "Authorization: Bearer <token>" 
 <baseurl>:8089/services/search/jobs/export --data search="savedsearch abc_backup_status" -d output_mode=csv')

request call ::::

BASE_URL = '<baseurl>:8089/services/search/jobs/export'
data = {"search":"savedsearch abc_backup_status"}
headers = {'Authorization': "Bearer <token>"}
auth_response = requests.get(BASE_URL, headers=headers, data = data, verify=False)

this is giving 400 errors.

Solution

  • The curl options -d OR --data imply a POST method by default.

    From: https://man7.org/linux/man-pages/man1/curl.1.html

      -d, --data <data>
        (HTTP MQTT) Sends the specified data in a POST request to
        the HTTP server, in the same way that a browser does when
        a user has filled in an HTML form and presses the submit
        button. This will cause curl to pass the data to the
        server using the content-type application/x-www-form-
        urlencoded.  Compare to -F, --form.

    It is interesting that Splunk Docs claim that search/jobs/export takes a GET, but you're creating a job to immediately export, which feels like a POST type of operation.

    Also I notice that your search starts with the savedsearch command, if that's a regularly scheduled savedsearch, you may want to GET saved/searches/{name}/history to get the last execution SID, followed either by the results or events endpoint of that already executed job, instead of a new search.... but that's a use case question