topic Re: How to use PowerShell to export a saved search using invoke-restmethod? in Reporting

How to use PowerShell to export a saved search using invoke-restmethod?

vandelin — Mon, 08 Jun 2020 20:29:02 GMT

Hi All,

I need to turn this:

curl --insecure -k -u username "https://api.splunk.company.com:443/servicesNS/username/sse_sitescope_prod_v01/saved/searches/apisearchv3/history"

Into a PowerShell equivalent:

api.splunk.company.com:443 is not trusted, as it does not have an SSL cert.

I've read many examples, I just want to export this saved search using invoke-restmethod

Can anyone assist?

Re: How to use PowerShell to export a saved search using invoke-restmethod?

vandelin — Fri, 29 May 2020 16:43:48 GMT

In the end i want the history for the sid and then i want to call:
curl --insecure -u username "https://api.splunk.company.com:443/services/search/jobs/Enter sid/results?count=0"

Re: How to use PowerShell to export a saved search using invoke-restmethod?

richgalloway — Fri, 29 May 2020 16:49:33 GMT

If you use powershell version 6 then you can add -SkipCertificateCheck.

Re: How to use PowerShell to export a saved search using invoke-restmethod?

vandelin — Fri, 29 May 2020 17:52:34 GMT

I appreciate the response.

I just can't seem to get the entire invoke-restmethod command down pat

I can work with the cert issue , i see where you can search splunk with invoke-restmethod.

I want to be able to have powershell invoke-restmethod and export a saved search

Re: How to use PowerShell to export a saved search using invoke-restmethod?

richgalloway — Fri, 29 May 2020 18:38:32 GMT

If you don't have powershell 6 then there are other ways to avoid checking certificates. Google can help find them.

Re: How to use PowerShell to export a saved search using invoke-restmethod?

vandelin — Fri, 29 May 2020 18:45:52 GMT

i was just mentioning that my curl command had --insecure because it will throw ssl errors at you and not run if you dont because the site is not trusted/has an ssl cert

Skipping certs is just one line that I already have

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

But I'm to form the entire 10 other lines, i cant find a good example to work with when exporting a saved search

$search=""https://api.splunk.company.com:443/services/search/jobs/scheduler__username_c3NlX3NpdGVzY29wZV9wcm9kX3YwMQ__usernameapisearchv3_at_1590751800_36332_8CEC1426-6D01-4FD1-8F3C-31B0C726D471/results?count=0" <-- im trying to do something like this 

#$search = $servar # Cmdlet handles urlencoding

       $body = @{

       search = $search

       output_mode = "json"

       earliest_time = "-31d"

       latest_time = "-5d"

       }

       Invoke-RestMethod -Method get -Uri $url -Credential $cred -Body $body

Regards,

Re: How to use PowerShell to export a saved search using invoke-restmethod?

vandelin — Fri, 29 May 2020 18:46:38 GMT

I don't know why it formatted it like this, but, it is what it is