REST search issue using Postman

gartnerj — Thu, 25 Apr 2019 18:33:14 GMT

I have the authorization done, and when I do the POST to do a search I keep getting the error:
(note AAAA and bbb, nnnnnn are the correct host and logpath values in my actual search)

<messages>
        <msg type="DEBUG">Configuration initialization for /var/splunkhot/splunk/etc took 143ms when dispatching a search (search ID: 1556216277.24597_33CF52FC-F282-491A-875E-F8EC1EB01F4C)</msg>
        <msg type="DEBUG">Invalid eval expression for 'EVAL-url_length' in stanza [pan:threat]: The expression is malformed. Expected LIKE.</msg>
        <msg type="DEBUG">base lispy: [ AND host::AAAAAAA source::/app/jboss/bbbb/log/server.log ]</msg>
        <msg type="DEBUG">search context: user="nnnnnnnn", app="search", bs-pathname="/var/splunkhot/splunk/etc"</msg>
    </messages>

The actual search I have in the body is this )

 search=search+host%3DAAAAAA+source%3D%2Fapp%2Fjboss%2Fbbbbb%2Flog%2Fserver.log+%7C+search+ERROR+earliest%3D-4h

I've tried a bunch of different variations, but I am always getting th EVAL-url Length error.
I even did JUST

search=search+host%3DAAAAAA

and still got the error!

Any ideas here on how to format the search correctly to get this to run without that error? I can run the search directly in SPLUNK so it does in fact work.

topic REST search issue using Postman in Splunk Search

REST search issue using Postman