Not sure if this has been raised before but I couldn't find anything.
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" latest_time="rt"
works perfectly.
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" latest_time="rt" output_mode="json"
Does not return anything. Is this intended behavior or just a missing feature?
Add -d to the http post data requests. So in this case, I believe the correct curl string would be:
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" -d latest_time="rt" -d output_mode="json"
Add -d to the http post data requests. So in this case, I believe the correct curl string would be:
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=sometype" -d earliest_time="rt-30m" -d latest_time="rt" -d output_mode="json"
This gives me a 404 on Splunk 5.0.