Issue with REST API

Graylog Central (peer support)
,
1

Hi, I am having an issue with the REST API.
My query is:
https://1.1.1.1:9000/api/search/universal/absolute?query=streams%3A621f6cd112205f090575c4a7&from=2025-01-08%2001%3A00%3A00&to=2025-01-08%2015%3A00%3A00&decorate=true

This works fine and returns result when I use he API browser in graylog, but when trying to use the same query in something like postman I get the following error:

“must not be empty (path = AbsoluteSearchResource.searchAbsoluteChunked.arg7, invalidValue = null)”

I can run a different query in postman like “https://1.1.1.1:9000/api/streams” and it returns results fine, so I know my auth settings etc are fine.

I am currently running Ubuntu 20.04.6 LTS with Graylog Open 6.1, which I recently updated from 5.2 (I didn’t test these queries in the older version, so I’m not sure if it worked before the upgrade.

Looking for any help possible because I’m going crazy with this.
Thanks!

2

With this URL, there are two endpoint methods that differ from the response content type. Did you set the expected response content type in your call?

Also, the endpoint is “legacy” and deprecated - so if you’re just starting out with using the API, I would like to suggest that you look at the scripting API Search Scripting API

2 Likes