Different results when using the Splunk search bar versus searching over HTTP.

dacmc — Tue, 07 Nov 2017 23:23:18 GMT

For Splunk events with this kind of payload

[TS: Tue Jul 4 19:28:00 2017 PDT] [PPTID: tid1] [ABC: XYZ][ASD: YHG1] [ANDG: ldsnfn] [PPID: id1]

this query when fired using "Splunk search" returns

index=sampleindex sourcetype=samplesourcetype

gives output like this
PPTID PPID TS
tid1 id1 Tue Jul 4 19:28:00 2017 PDT

When I fire the same search over HTTP to Splunk server , the query never returns

How should the query be for using over http ?

Splunk version: 6.6.3

Re: Different results when using the Splunk search bar versus searching over HTTP.

akheraj_splunk — Wed, 08 Nov 2017 17:34:27 GMT

Have you tried the curl --data-urlencode option instead of -d? I suspect it's because your query is being mangled in transport. Do the Splunk logs give you any information on the search that was received when sent my curl?

topic Re: Different results when using the Splunk search bar versus searching over HTTP. in Getting Data In

Different results when using the Splunk search bar versus searching over HTTP.

Re: Different results when using the Splunk search bar versus searching over HTTP.