{
  "opencollection": "1.0.0",
  "info": {
    "name": "Splunk Enterprise REST Data Inputs Search API",
    "version": "9.4.0"
  },
  "request": {
    "auth": {
      "type": "bearer",
      "token": "{{bearerToken}}"
    }
  },
  "items": [
    {
      "info": {
        "name": "Search",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "List Search Jobs",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{host}:{port}/services/search/jobs",
            "params": [
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              },
              {
                "name": "count",
                "value": "",
                "type": "query",
                "description": "Maximum number of items to return. A value of 0 returns all items."
              },
              {
                "name": "offset",
                "value": "",
                "type": "query",
                "description": "Index of the first item to return. Used with count for pagination."
              },
              {
                "name": "search",
                "value": "example_value",
                "type": "query",
                "description": "Filter search jobs by search string"
              },
              {
                "name": "sort_key",
                "value": "example_value",
                "type": "query",
                "description": "Field to sort by"
              },
              {
                "name": "sort_dir",
                "value": "asc",
                "type": "query",
                "description": "Sort direction"
              }
            ]
          },
          "docs": "Returns a list of current search jobs for the authenticated user. Includes job status, progress, and metadata for each job."
        },
        {
          "info": {
            "name": "Create a Search Job",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{host}:{port}/services/search/jobs",
            "params": [
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              }
            ],
            "body": {
              "type": "form-urlencoded",
              "data": []
            }
          },
          "docs": "Creates a new search job. The search job runs asynchronously. Use the returned search ID (sid) to check job status and retrieve results. Searches use the Splunk Search Processing Language (SPL)."
        },
        {
          "info": {
            "name": "Get Search Job Details",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{host}:{port}/services/search/jobs/:search_id",
            "params": [
              {
                "name": "search_id",
                "value": "",
                "type": "path",
                "description": "The search ID (sid) of the search job"
              },
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              }
            ]
          },
          "docs": "Returns detailed information about a specific search job including its status, progress, performance metrics, and configuration."
        },
        {
          "info": {
            "name": "Delete a Search Job",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{host}:{port}/services/search/jobs/:search_id",
            "params": [
              {
                "name": "search_id",
                "value": "",
                "type": "path",
                "description": "The search ID (sid) of the search job"
              }
            ]
          },
          "docs": "Cancels and deletes the specified search job and its results."
        },
        {
          "info": {
            "name": "Control a Search Job",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{host}:{port}/services/search/jobs/:search_id/control",
            "params": [
              {
                "name": "search_id",
                "value": "",
                "type": "path",
                "description": "The search ID (sid) of the search job"
              },
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              }
            ],
            "body": {
              "type": "form-urlencoded",
              "data": [
                {
                  "name": "action",
                  "value": ""
                },
                {
                  "name": "ttl",
                  "value": ""
                },
                {
                  "name": "priority",
                  "value": ""
                }
              ]
            }
          },
          "docs": "Execute a control action on a search job such as pause, unpause, finalize, cancel, or touch (extend the job lifetime)."
        },
        {
          "info": {
            "name": "Get Search Results",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{host}:{port}/services/search/jobs/:search_id/results",
            "params": [
              {
                "name": "search_id",
                "value": "",
                "type": "path",
                "description": "The search ID (sid) of the search job"
              },
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              },
              {
                "name": "count",
                "value": "",
                "type": "query",
                "description": "Maximum number of items to return. A value of 0 returns all items."
              },
              {
                "name": "offset",
                "value": "",
                "type": "query",
                "description": "Index of the first item to return. Used with count for pagination."
              },
              {
                "name": "search",
                "value": "example_value",
                "type": "query",
                "description": "Post-processing search string to filter results"
              },
              {
                "name": "field_list",
                "value": "example_value",
                "type": "query",
                "description": "Comma-separated list of fields to return"
              }
            ]
          },
          "docs": "Returns the results of a completed search job. Results are available only after the search job has finished. Use the count and offset parameters for pagination."
        },
        {
          "info": {
            "name": "Get Search Events",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{host}:{port}/services/search/jobs/:search_id/events",
            "params": [
              {
                "name": "search_id",
                "value": "",
                "type": "path",
                "description": "The search ID (sid) of the search job"
              },
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              },
              {
                "name": "count",
                "value": "",
                "type": "query",
                "description": "Maximum number of items to return. A value of 0 returns all items."
              },
              {
                "name": "offset",
                "value": "",
                "type": "query",
                "description": "Index of the first item to return. Used with count for pagination."
              },
              {
                "name": "earliest_time",
                "value": "example_value",
                "type": "query",
                "description": "Earliest time boundary for events"
              },
              {
                "name": "latest_time",
                "value": "example_value",
                "type": "query",
                "description": "Latest time boundary for events"
              },
              {
                "name": "search",
                "value": "example_value",
                "type": "query",
                "description": "Post-processing search to filter events"
              },
              {
                "name": "field_list",
                "value": "example_value",
                "type": "query",
                "description": "Comma-separated list of fields to return"
              },
              {
                "name": "truncation_mode",
                "value": "abstract",
                "type": "query",
                "description": "How to truncate long lines"
              },
              {
                "name": "max_lines",
                "value": "10",
                "type": "query",
                "description": "Maximum number of lines per event"
              }
            ]
          },
          "docs": "Returns the untransformed events of a search job. Unlike results, events return the raw data before any transforming commands are applied. Available for searches that include non-transforming commands."
        },
        {
          "info": {
            "name": "Export Search Results",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{host}:{port}/services/search/jobs/export",
            "params": [
              {
                "name": "search",
                "value": "example_value",
                "type": "query",
                "description": "The SPL search query to execute"
              },
              {
                "name": "output_mode",
                "value": "",
                "type": "query",
                "description": "Response format"
              },
              {
                "name": "earliest_time",
                "value": "example_value",
                "type": "query",
                "description": "Earliest time for the search"
              },
              {
                "name": "latest_time",
                "value": "example_value",
                "type": "query",
                "description": "Latest time for the search"
              },
              {
                "name": "auto_cancel",
                "value": "10",
                "type": "query",
                "description": "Seconds of inactivity after which the search is cancelled"
              },
              {
                "name": "enable_lookups",
                "value": "true",
                "type": "query",
                "description": "Whether to enable lookups during the search"
              }
            ]
          },
          "docs": "Runs a search and streams results back as they become available, rather than waiting for the search to complete. This is a streaming endpoint suitable for long-running searches or real-time searches. The search runs synchronously and results stream back in the response."
        }
      ]
    }
  ],
  "bundled": true
}