REST API oneshot blocking saved search

[leecaf]

EDIT:
I've gotten some help from Splunk support team and now can get oneshot blocking calls working using the url below:

https://localhost:8089/services/search/jobs?exec_mode=oneshot&output_mode=json&search="search index=_internal | head 10"

however it is unclear to me how I would invoke a oneshot REST call to a saved service. I'm guessing it would look something like the url below but haven't had any success after playign with a few combinations usually a '404 not found':

https://localhost:8089/saved/searches/{name}?exec_mode=oneshot&output_mode=json

can someone help please?

The eventual goal is to be able to import data from splunk into Excel much like how a CSV would be imported.

[Flynt]

What about calling the saved search via the search command itself from the CLI? IE

curl -k -u admin:changeme -d 'search="savedsearch \"Errors in the last 24 hours\""' -d "output_mode=json" -d "exec_mode=oneshot" https://localhost:8089/servicesNS/admin/search/search/jobs/export

[dart]

You might find the OData for Splunk app to be a better option.

However, to answer your question, it's hard to see from the data you have supplied. It looks like you have "search=index=_internal |head 5", where you would want search index=_internal | head 5 as the specific error message is saying it's missing a search command (i.e. search) before a quote mark.

[leecaf]

I've tried OData many thanks to Neeraj Luthra. but I'm what I'm trying to do probably doesn't require OData. The problem I'm facing is while OData works nicely out of the box, excel parses the XML it generates in a very verbose manner giving me much more data than I need. I'd rather not have to debug that side of things if Splunk REST API will do the trick for me.

[leecaf]

Thanks, emailed dev for OData.
corrected typo in my original post but still getting same error