Cannot POST /api/v1/search/jobs

Jonathan Rau · July 25

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.

Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot POST /api/v1/search/jobs</pre>
</body>
</html>

In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically

{
  "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "
}

In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive a valid token. Here is the relevant portion of that script.

def generateBearerToken() -> str:
    url = "https://login.cribl.cloud/oauth/token"

    headers = {"Content-Type": "application/json"}
    
    data = {
        "grant_type": "client_credentials",
        "client_id": CRIBL_API_CLIENT_ID,
        "client_secret": CRIBL_API_CLIENT_SECRET,
        "audience": "https://api.cribl.cloud"
    }
    
    response = requests.post(url, headers=headers, data=json.dumps(data))
    
    if response.status_code == 200:
        return response.json().get("access_token")
    else:
        raise CriblAuthError

def submitCriblSearchJob():
    authToken = generateBearerToken()

    url = f"https://main-{CRIBL_ORG_ID}.cribl.cloud/api/v1/search/jobs"

    headers = {
        "accept": "application/json",
        "Authorization": f"Bearer {authToken}",
        "Content-Type": "application/json"
    }

    data = {
        "query": f"cribl dataset='{TABLE_NAME}' | limit {RECORDS_LIMIT}"
    }

    r = requests.post(url, headers=headers, data=json.dumps(data))

    print(r.text)

I am slightly worried I'm missing something, or doing something stupid here, anyone have any clue or has run into this issue before?

Cannot POST /api/v1/search/jobs

Categories