I have spent most of the afternoon trying to work out why the script doesn't seem to work. From the logs I found in %SPLUNK_HOME%\var\log\splunk\
the commmand will never work as long as my search command contains quotes, braces, >, < or & anywhere. e.g
C:\WINDOWS\system32\cmd.exe /c " "pathtosplunk\Splunk\bin\scripts\myscript.py" "49" "index="my_index" ("some" OR "other") | rex field=blah "(?<breakage>.*)" commands" "name_of saved search" "Saved Search [nameofsavedsearch] number of events(99)" "http://path toresults" "" "path\\to\\csv" "
Is there any solution?
The only way I have managed to get this working is by re-writing %SPLUNK_HOME%\etc\apps\search\bin\runshellscript.py
Clearly this is not a good solution and will break after any update.