REST API Specific Search

[domtheluck]

Hi,

I try to do a search with Splunk REST API from a C# client.

I need to search some general term but I need to specify some information like the host, index etc.

Here is my query:

url:
https:1.1.1.1:8089/services/search/jobs

Args in request body:
search=search SOMETERMTOSEARCH host=HOSTNAMETOSEARCHWITHIN

Right now, it work if I specificy only the SOMETERMTOSEARCH. If I add the host=HOSTNAMETOSEARCHWITHIN, Splunk truncated it to search=search SOMETERMTOSEARCH host=. Same thing if I add index=MYINDEXNAME.

How can I specify these extra parameters?

i try to add them as arguments like earliest_time or latest_time but it's not work either.

Can someone help me?

[ugavnholt]

It sounds like you should urlEncode the portion of the string that are a value, ie:
"search=" + UrlEncode("search SOMETERMTOSEARCH host=HOSTNAMETOSEARCHWITHIN")

[domtheluck]

Thanks for your quick answer!

I will contact you shortly with my GitHub ID.

[psanford_splunk]

Hi - We will be releasing our C# SDK shortly and that should be able to help you. We can give you pre-release access now. Just send an email to: devinfo@splunk.com with your GitHub ID and we will get you access.