After connecting to the splunk Rest API, I would like to run a search query built like this and stored in a variable.
hostname is equal to a string variable
searchQuery= "Search | sourcetype=Audit agent_name=hostname| head 5"
I would also like to add in the earliest time as a variable... not sure where to add this. I would then like to return the SID and data in a json format.
Thanks for helping!
