Splunk Search

Run makeresults command through REST API is giving error

denissotoacc
Path Finder

I receive the following error while trying to execute a simple "makeresults" command by using REST API call:

Used endpoint:
https://localhost:8089/servicesNS/nobody/myapp/search/jobs

Search example:

"| makeresults | eval name=\"denis\""


Error message:
"Error in 'makeresults' command: This command must be the first command of a search."

"search": "search | makeresults | eval nombre=\"denis\""

I see that the API call changes my search adding a "search" word before the search itself. How can I get riddle of that?

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

This should work

[soutamo@vega] ~>
(0) $ curl -ku $PASS https://localhost:8089/servicesNS/-/search/search/jobs -d search=" |makeresults|eval name=\"denis\""
<?xml version="1.0" encoding="UTF-8"?>
<response>
  <sid>1688721961.24</sid>
</response>
[soutamo@vega] ~>
(0) $ export SID=1688721961.24 &&  curl -sku $PASS https://localhost:8089/services/search/jobs/$SID/results?output_mode=json|jq '.results'
[
  {
    "_time": "2023-07-07T12:26:02.000+03:00",
    "name": "denis"
  }
]
[soutamo@vega] ~>
(0) $

r. Ismo 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@denissotoacc 

Can you please share your sample code?

KV

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...