Getting Data In

How to format output of REST API using .Net.WebClient in Powershell?

williamberrysr
Engager

I have the following script. I am trying to format the output to CSV format, not HTML. Unfortunately the Output_Mode=csv does not work with the connection string. Any suggestions?

NOTE: I cannot use curl as I have to get the credentials from the end user prior to connection.

----- SCRIPT ------

function New-TrustAllWebClient {
    # Create a compilation environment
    $Provider=New-Object Microsoft.CSharp.CSharpCodeProvider
    $Compiler=$Provider.CreateCompiler()
    $Params=New-Object System.CodeDom.Compiler.CompilerParameters
    $Params.GenerateExecutable=$False
    $Params.GenerateInMemory=$True
    $Params.IncludeDebugInformation=$False
    $Params.ReferencedAssemblies.Add("System.DLL") > $null
    $TASource=@'
      namespace Local.ToolkitExtensions.Net.CertificatePolicy {
        public class TrustAll : System.Net.ICertificatePolicy {
          public TrustAll() { 
          }
          public bool CheckValidationResult(System.Net.ServicePoint sp,
            System.Security.Cryptography.X509Certificates.X509Certificate cert, 
            System.Net.WebRequest req, int problem) {
            return true;
          }
        }
      }
'@ 
    $TAResults=$Provider.CompileAssemblyFromSource($Params,$TASource)
    $TAAssembly=$TAResults.CompiledAssembly
    ## We now create an instance of the TrustAll and attach it to the ServicePointManager
    $TrustAll=$TAAssembly.CreateInstance("Local.ToolkitExtensions.Net.CertificatePolicy.TrustAll")
    [System.Net.ServicePointManager]::CertificatePolicy=$TrustAll
    ## The ESX Upload requires the Preauthenticate value to be true which is not the default
    ## for the System.Net.WebClient class which has very simple-to-use downloadFile and uploadfile
    ## methods.  We create an override class which simply sets that Preauthenticate value.
    ## After creating an instance of the Local.ToolkitExtensions.Net.WebClient class, we use it just
    ## like the standard WebClient class.
    $WCSource=@'
      namespace Local.ToolkitExtensions.Net {
        class WebClient : System.Net.WebClient {
          protected override System.Net.WebRequest GetWebRequest(System.Uri uri) {
            System.Net.WebRequest webRequest = base.GetWebRequest(uri);
            webRequest.PreAuthenticate = true;
            webRequest.Timeout = 10000;
            return webRequest;
          }
        }
      }
'@
    $WCResults=$Provider.CompileAssemblyFromSource($Params,$WCSource)
    $WCAssembly=$WCResults.CompiledAssembly
    ## Now return the custom WebClient. It behaves almost like a normal WebClient.
    $WebClient=$WCAssembly.CreateInstance("Local.ToolkitExtensions.Net.WebClient")
    return $WebClient
}
# Example of using this function to upload a file over SSL.
# Notice that the object you get back from New-TrustAllWebClient is almost identical
# to what you would get from new-object system.net.webclient.
 $loc=get-location 
 $wc = New-TrustAllWebClient
 $credential = get-credential
 $wc.set_Credentials($credential.GetNetworkCredential())
 $URL = "https://iosplunkprd-v5:8089/services/search/jobs/export"
 $wc.UploadString($URL, "POST", "search=search EventCode=4740 user=* daysago=1 |Table Caller_Computer_Name,_time") 
0 Karma
1 Solution

williamberrysr
Engager

Disregard.... I found the answer. I have to use the & sign and then the output format.

$wc.UploadString($URL, "POST", "search=search EventCode=4740 user=* daysago=1 |Table Caller_Computer_Name,_time&output_mode=csv")

View solution in original post

williamberrysr
Engager

Disregard.... I found the answer. I have to use the & sign and then the output format.

$wc.UploadString($URL, "POST", "search=search EventCode=4740 user=* daysago=1 |Table Caller_Computer_Name,_time&output_mode=csv")
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...