&dispatch.sample_ratio=10 appears in the URL when I select 1:10.
So i will assume something like that is what you want to add to your request.
I did some testing, and I get multiple lists of results back.
The first list of results is the sample.
I dont like how the results still had all 15 billion results even though the sample ratio was set. So I used a similar technique to achieve similar results. First I created a command called randomint, then i used it in my search like this:
...| randomint 1 100| where randomint=2
...| randomint 1 100| where randomint=34
This will give a ratio of 1:100 of random events when executed by the API. I put the randomint command in my toolkit app: https://splunkbase.splunk.com/app/3265/
Basically you're attaching a field called randomint to all the events in the search pipeline, and then you're using a where clause to narrow down to just events that match 1 number between 1 and 100. If you wanted a different ration, you'd just do something like
...| randomint 1:50 | where randomint=17
The following worked for me.
$ splunk search 'index=_internal | stats count' -index_earliest 1493132552 -index_latest 1493404081 -sample_ratio 1000 INFO: Sampling disables usage of report acceleration summaries. INFO: This search is sampling approximately 1 out of every 1000 events (seed=1317954456) count ----- 58 $ curl -sku user:pass https://localhost:8089/services/search/jobs/export --data-urlencode search='search index=_internal | stats count' -d output_mode=csv -d earliest_time='1493132552' -d latest_time='1493404081' -d sample_ratio='1000' count 46