Splunk Search

Converting Splunk Curl API to Windows Powershell

qcjacobo2577
Path Finder

I have a working script that allows me to retrieve the job ID of a search in Splunk.  This is working in Windows using GNU curl (and is also working --- albeit modified --- in the native Ubuntu Linux version of curl).

I am now trying to take this same approach and run it in Windows Powershell --- unfortunately, I have not yet been successful. Here is what I have so far (working curl version is shown first).

 

curl.exe -k -H "Authorization: Bearer <MYTOKEN>" https://<MYINSTANCE>.splunkcloud.com:8089/services/search/jobs/ --data-urlencode  search='<MYSEARCH>'

============
============

$headers = @{
    "Authorization" = "Bearer <MYTOKEN>"
}
$body = @{
    "search" = "<MYSEARCH>"
}
$response = Invoke-WebRequest -Uri "https://<MYINSTANCE>.splunkcloud.com:8089/services/search/jobs/" `
    -Method Post `
    -Headers $headers `
    -ContentType "application/x-www-form-urlencoded" `
    -Body $body `

 

 

Any guidance is appreciated. 

Tags (2)
0 Karma
1 Solution

qcjacobo2577
Path Finder

@richgalloway Figured it out --- had an extra "`" character at the end.  It is working now.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

What error do you get from PowerShell?

I see curl uses the -k option, but PowerShell does not use the equivalent -SkipCertificateCheck option.  Perhaps that is a factor.

---
If this reply helps you, Karma would be appreciated.
0 Karma

qcjacobo2577
Path Finder

@richgalloway I thought the same thing as that did generate an error.  If I simply remove that line, I get the following error:

Incomplete string token.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : IncompleteString
0 Karma

qcjacobo2577
Path Finder

@richgalloway Figured it out --- had an extra "`" character at the end.  It is working now.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...