Getting Data In

How to format output of REST API using .Net.WebClient in Powershell?

williamberrysr
Engager

I have the following script. I am trying to format the output to CSV format, not HTML. Unfortunately the Output_Mode=csv does not work with the connection string. Any suggestions?

NOTE: I cannot use curl as I have to get the credentials from the end user prior to connection.

----- SCRIPT ------

function New-TrustAllWebClient {
    # Create a compilation environment
    $Provider=New-Object Microsoft.CSharp.CSharpCodeProvider
    $Compiler=$Provider.CreateCompiler()
    $Params=New-Object System.CodeDom.Compiler.CompilerParameters
    $Params.GenerateExecutable=$False
    $Params.GenerateInMemory=$True
    $Params.IncludeDebugInformation=$False
    $Params.ReferencedAssemblies.Add("System.DLL") > $null
    $TASource=@'
      namespace Local.ToolkitExtensions.Net.CertificatePolicy {
        public class TrustAll : System.Net.ICertificatePolicy {
          public TrustAll() { 
          }
          public bool CheckValidationResult(System.Net.ServicePoint sp,
            System.Security.Cryptography.X509Certificates.X509Certificate cert, 
            System.Net.WebRequest req, int problem) {
            return true;
          }
        }
      }
'@ 
    $TAResults=$Provider.CompileAssemblyFromSource($Params,$TASource)
    $TAAssembly=$TAResults.CompiledAssembly
    ## We now create an instance of the TrustAll and attach it to the ServicePointManager
    $TrustAll=$TAAssembly.CreateInstance("Local.ToolkitExtensions.Net.CertificatePolicy.TrustAll")
    [System.Net.ServicePointManager]::CertificatePolicy=$TrustAll
    ## The ESX Upload requires the Preauthenticate value to be true which is not the default
    ## for the System.Net.WebClient class which has very simple-to-use downloadFile and uploadfile
    ## methods.  We create an override class which simply sets that Preauthenticate value.
    ## After creating an instance of the Local.ToolkitExtensions.Net.WebClient class, we use it just
    ## like the standard WebClient class.
    $WCSource=@'
      namespace Local.ToolkitExtensions.Net {
        class WebClient : System.Net.WebClient {
          protected override System.Net.WebRequest GetWebRequest(System.Uri uri) {
            System.Net.WebRequest webRequest = base.GetWebRequest(uri);
            webRequest.PreAuthenticate = true;
            webRequest.Timeout = 10000;
            return webRequest;
          }
        }
      }
'@
    $WCResults=$Provider.CompileAssemblyFromSource($Params,$WCSource)
    $WCAssembly=$WCResults.CompiledAssembly
    ## Now return the custom WebClient. It behaves almost like a normal WebClient.
    $WebClient=$WCAssembly.CreateInstance("Local.ToolkitExtensions.Net.WebClient")
    return $WebClient
}
# Example of using this function to upload a file over SSL.
# Notice that the object you get back from New-TrustAllWebClient is almost identical
# to what you would get from new-object system.net.webclient.
 $loc=get-location 
 $wc = New-TrustAllWebClient
 $credential = get-credential
 $wc.set_Credentials($credential.GetNetworkCredential())
 $URL = "https://iosplunkprd-v5:8089/services/search/jobs/export"
 $wc.UploadString($URL, "POST", "search=search EventCode=4740 user=* daysago=1 |Table Caller_Computer_Name,_time") 
0 Karma
1 Solution

williamberrysr
Engager

Disregard.... I found the answer. I have to use the & sign and then the output format.

$wc.UploadString($URL, "POST", "search=search EventCode=4740 user=* daysago=1 |Table Caller_Computer_Name,_time&output_mode=csv")

View solution in original post

williamberrysr
Engager

Disregard.... I found the answer. I have to use the & sign and then the output format.

$wc.UploadString($URL, "POST", "search=search EventCode=4740 user=* daysago=1 |Table Caller_Computer_Name,_time&output_mode=csv")
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...