How retrieve search results via Splunk API?

[qcjacobo2577]

I recently enabled Splunk tokens (using SAML authentication) and am able to successfully execute basic API calls (such as the one below).

curl -H "Authorization: Bearer <token>" -X GET https://<host>.splunkcloud.com:8089/services/authorization/roles

I have a Splunk search that works great from the Splunk Cloud UI, but I would like to be able to retrieve the same data in either JSON or CSV format.  I have attempted to follow the Splunk documentation on this, but being brand new may simply be missing something. 

• What is the best way to achive my goal in this case?
• Is using Splunk tokens the preferred/best approach?

[yuanliu · Accepted solution]

To perform a search, you first post it to the search endpoint as a job.

curl -H "Authorization: Bearer <token>" https://<host>.splunkcloud.com:8089/services/search/job -d search="my great search"

This will submit "my great search" and return an XML document.  You then use the value of the document's <sid /> segment get the result, like this

curl -H "Authorization: Bearer <token>" --get https://<host>.splunkcloud.com:8089/services/search/job/<sid>/result" -d output_mode=json

Of course, you can use output_mode=json in the first command and use the sid node of the JSON document.