Different results when using the Splunk search bar versus searching over HTTP.

[dacmc]

For Splunk events with this kind of payload

[TS: Tue Jul 4 19:28:00 2017 PDT] [PPTID: tid1] [ABC: XYZ][ASD: YHG1] [ANDG: ldsnfn] [PPID: id1]

this query when fired using "Splunk search" returns

index=sampleindex sourcetype=samplesourcetype

gives output like this
PPTID PPID TS
tid1 id1 Tue Jul 4 19:28:00 2017 PDT

When I fire the same search over HTTP to Splunk server , the query never returns

How should the query be for using over http ?

Splunk version: 6.6.3

[akheraj_splunk]

Have you tried the curl --data-urlencode option instead of -d? I suspect it's because your query is being mangled in transport. Do the Splunk logs give you any information on the search that was received when sent my curl?