Getting Data In

Trying to make Splunk Rest API search request and got 400 bad request

New Member

I'm trying to send the following Request body (Using Splunk Rest API, C#):
search = |inputlookup mylookup | eval week_ago=strftime(relativetime(now(), "-7d@d"), "%Y-%m-%d %H:%M:%S") | where record_created>week_ago

Post request to:
https://mysplunkuri:8089/servicesNS/~/search/search/jobs
Headers:
Content-Type: application/x-www-form-urlencoded
Authorization: Basic (base64Stringofmycredentials)

And got 400 bad request.

If I'm trying the following query:
search = |inputlookup mylookup | where record_created>"2019-04-16 00:00:00"

Its return status code 200 (OK).

All the queries above works in splunk.

What I'm doing wrong?

Tags (3)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!