If you wish to Search the API via command line (using the Splunk Binary included in the Forwarder package for example) it is executed as follows:
$SPLUNK_HOME/bin/splunk search 'yoursearch' -uri 'https://splunkAPI_Instance:8089/'
This works great on its own, however, prompts for User & Password on execution. Making scripted extraction of splunk data to export to local file called from a cron job or otherwise difficult.
My Question is, how can you execute the same and provide the username & password the way one might with CURL or WGET in the command request itself?
CURL example:
curl -k -u admin:pass https://splunkAPI_Instance:8089/services/saved/searches \
-d name=MySavedSearch \
--data-urlencode search="index=_internal source=*metrics.log"
CURL outlined in Splunk Documentation References:
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTUM/RESTusing
I can't seem to find any documentation (in this REST User doc or otherwise) around passing the username & password via command line when specifically leveraging the splunk forwarder/binary. (Without also the SDK and adding Python or Ruby to the mix).
Side note: CURL & WGET are prohibited from being installed on the server where the forwarder in this scenario happens to exist, so it would be ideal to use the forwarder installation itself to perform the search since it is already there and available to local users of that (unix) system.
Once solution identified, the following should be updated to reflect the same information:
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/AboutCLIsearches
http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTTUT/RESTsearches
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTUM/RESTusing#Authentication_and_authorization
