Executing search query on a remote Splunk Instance, may be using REST command or Command line

[somesoni2]

Hi,
I have a requirement to execute a query on different SPlunk instances (different environmet). Adding them as search peer is not an options (limitation), hence I was wondering if we have any options, either REST command or using command line, to execute a search on a remote Splunk instance and get the search result.

If it can be done by REST, I may be able to automate the same.

Thanks in advanced.

[omerl]

I made a search command to do it easily.

Probably too late for this issue, but maybe someone will find it helpful and simpler than using the REST API directly:
https://github.com/omerl13/remote-splunk-search

Usage will be like:

| remote 
    host="mysplunk2.com" 
    query="index=main | head 50 | table _time host _raw" 
    username="user" 
    password="changeme"

(Tokens are also supported)

[Damien_Dallimor]

This can certainly be accomplished via the Splunk REST API.

And we have several language SDKs with comprehensive searching examples to make it easier to do this.

[Ayn · Accepted solution]

What exactly is the limitation that makes you unable to add the remote instances as search peers? The search head will be communicating with its search peers solely through the REST API, so...

Otherwise you could either query the remote instance simply by issuing a search through the splunk CLI, by adding the uri parameter:

$SPLUNK_HOME/bin/splunk search 'yoursearch' -uri 'https://remoteinstance:8089/'

Or you could use one of the existing SDK's to issue searches via the REST API.

[shivarpith]

how do i export the above results to a text or csv?