I can't find documentation anywhere on how to format search strings for the Splunk SDK. Every single example provided just uses:
search index=_internal | head 10
I'm just trying to search on a custom field I use in my application, so I thought this would work:
search index=myindex mycustomfield=xyz
but that just gives me an error: Bad Request: FATAL: Unknown search command mycustomfield
How do I format this as I want? And perhaps more importantly where is this documented how the SDK expects requests to be formatted?
@micahkemp that actually did help but not for the reason you would think...turns out it was a dumb mistake on my part, I had two variables declared named search and searchStr and i mixed the two up and was passing in the wrong one without the 'search' part at the beginning. Stupid mistake but thanks for the tip
Can you provide us with a sample of the code you're using to get this error?