https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49208#M9356 <P>This gives me a 404 on Splunk 5.0.</P> Mon, 16 Sep 2013 20:36:47 GMT ff_djimenez 2013-09-16T20:36:47Z https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49206#M9354 <P>Not sure if this has been raised before but I couldn't find anything.</P> <PRE><CODE>curl -k -u admin:changeme <A href="https://localhost:8089/services/search/jobs/export" target="test_blank">https://localhost:8089/services/search/jobs/export</A> -d search="search sourcetype=sometype" -d earliest_time="rt-30m" latest_time="rt" </CODE></PRE> <P>works perfectly.</P> <PRE><CODE>curl -k -u admin:changeme <A href="https://localhost:8089/services/search/jobs/export" target="test_blank">https://localhost:8089/services/search/jobs/export</A> -d search="search sourcetype=sometype" -d earliest_time="rt-30m" latest_time="rt" output_mode="json" </CODE></PRE> <P>Does not return anything. Is this intended behavior or just a missing feature?</P> Fri, 11 May 2012 06:49:59 GMT https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49206#M9354 johandk 2012-05-11T06:49:59Z https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49207#M9355 <P>Add -d to the http post data requests. So in this case, I believe the correct curl string would be:</P> <P>curl -k -u admin:changeme <A href="https://localhost:8089/services/search/jobs/export" target="_blank">https://localhost:8089/services/search/jobs/export</A> -d search="search sourcetype=sometype" -d earliest_time="rt-30m" -d latest_time="rt" -d output_mode="json"</P> Mon, 28 Sep 2020 12:19:47 GMT https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49207#M9355 gstewart 2020-09-28T12:19:47Z https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49208#M9356 <P>This gives me a 404 on Splunk 5.0.</P> Mon, 16 Sep 2013 20:36:47 GMT https://community.splunk.com/t5/Getting-Data-In/REST-API-realtime-searches-with-output-mode-set-to-json/m-p/49208#M9356 ff_djimenez 2013-09-16T20:36:47Z