Splunk Enterprise

Search Reference

Download manual as PDF

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.



Access a REST endpoint and display the returned entities as search results.


rest <rest-uri> [splunk_server=<string>] (<get-arg-name>=<get-arg-value>)...

Required arguments

Syntax: <uri>
Description: URI path to the REST endpoint.
Syntax: <string>
Description: REST argument name.
Syntax: <string>
Description: REST argument value.

Optional arguments

Syntax: splunk_server=<string>
Description: Optional, argument specifies whether or not to limit results to one specific server. Use "local" to refer to the search head.


Example 1: Access saved search jobs.

| rest /services/search/jobs count=0 splunk_server=local | search isSaved=1


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the rest command.


This documentation applies to the following versions of Splunk: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7 View the Article History for its revisions.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole
Feedback you enter here will be delivered to the documentation team

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters