Business. Not Family
Cry me a river mac people.
So Splunk 3.2 is really pissing me off. For the life of me I can’t figure out how to use the REST API. There’s something (ok a lot of things) that the online documentation just doesn’t tell you. I figured the syntax to create a new search would be similar (said identical) to how you use it in the Web UI…but it isn’t. The documentation on the site is literally starved for examples. I’d like to know how exactly they’re using the query parameters they describe, because I’ve used just about every incantation I can think of, and my searches don’t return didly squat.
You could say I’m very frustrated. I need to have it ready for a potential dire need at work and frankly it doesn’t look like it’s going to be ready. I don’t think Splunk is using their own REST API in their product either. The reason I say that is all the requests to /v3/ in 3.2. Didn’t you guys say that was deprecated?
- simplexml and namespaces
- gltrail
- monitor webpage changes with specto
- tuning postgresql for performance
- amazon drm free music and linux
- firecookie
- taffy db javascript database
- php predefined constants
- php universal feed generator
- git revert is not equivalent to svn revert
- command line automation with expect-lite
- pay me please
- 7 reasons you shouldn’t charge by the hour
- include – pack your javascript with ease
- highlight search results with javascript
- invoice machine
- porticus
- 5 steps to a DIY lifelock
- checkpoints and the background writer
- spec viewperf
- 7 ways to decrease your hours without harming your career
- pulling truly random rows from a table
March 19th, 2008 at 2:09 pm
Hey Tim!
Sorry you are having problems with the new REST endpoints. Yes, 3.2 has new endpoints (running off Splunkd), but the old /v3/ endpoints are still running on SplunkWeb.
The new APIs provide three basic services right now, including auth, search job creation, and reading from a search. We still have a bit of work to do to get the rest of the methods in Splunk exposed via REST, including server admin, inputs, and user management. Expect those in subsequent releases of 3.2.
For more documentation head over to the developer’s wiki: http://code.google.com/p/splunk-labs/. We’re adding examples regularly (yes it’s light right now on examples), and encouraging others to do so as well. We’ll have a proper wiki up on Splunk.com within in a month.
Lastly, if you have questions, be sure to use support. If they can’t help you get going, they’ll send you on to the platform group (of which I’m part of). You can also contact me directly!