I'm using curl and the REST API to submit a job and fetch the results by search id. What I'd like to do is, rather than fetching the results of the original search job, run another query against the search job's results by passing the search param to the results endpoint, like so:
curl -u admin:password -k https://myhost:8089/services/search/jobs/1529524989.3734/results
--get -d output_mode=csv -d search="search foo=bar"
The Splunk docs say you can pass any valid search to results, but I can't get this second query to have any effect on the result set I get back - I get the same data no matter what. I must be missing some special syntax. Any ideas?
