Skip to main content

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.

Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error

<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>

In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically

{  "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}

In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive a valid token. Here is the relevant portion of that script.

def generateBearerToken() -> str:  url = "https://login.cribl.cloud/oauth/token"  headers = {"Content-Type": "application/json"}    data = {  "grant_type": "client_credentials",  "client_id": CRIBL_API_CLIENT_ID,  "client_secret": CRIBL_API_CLIENT_SECRET,  "audience": "https://api.cribl.cloud"  }    response = requests.post(url, headers=headers, data=json.dumps(data))    if response.status_code == 200:  return response.json().get("access_token")  else:  raise CriblAuthErrordef submitCriblSearchJob():  authToken = generateBearerToken()  url = f"https://main-{CRIBL_ORG_ID}.cribl.cloud/api/v1/search/jobs"  headers = {  "accept": "application/json",  "Authorization": f"Bearer {authToken}",  "Content-Type": "application/json"  }  data = {  "query": f"cribl dataset='{TABLE_NAME}' | limit {RECORDS_LIMIT}"  }  r = requests.post(url, headers=headers, data=json.dumps(data))  print(r.text)

I am slightly worried I'm missing something, or doing something stupid here, anyone have any clue or has run into this issue before?

Be the first to reply!

Reply


Terms & ConditionsCookie settings