Problem trying to use remote CLI

[bcotton]

When trying to run a search from a remote CLI instance, I keep getting a 404.

The command-line I'm running is:

./splunk search bob -uri http://dsc-splunksearch-01:8000 -auth <....>

and the web_access.log says this:

10.32.12.137 - - [04/Apr/2011:12:27:24] "POST /services/search/jobs/export HTTP/1.1" 303 176 "" "SplunkCli/4.1 (build 89596)" - 4d9a0d8cfa1d6c08d0 10.32.12.137 - - [04/Apr/2011:12:27:24] "GET /en-US/services/search/jobs/export HTTP/1.1" 404 2544 "" "SplunkCli/4.1 (build 89596)" - 4d9a0d8cfb1d6c08d0

[Stephen_Sorkin · Accepted solution]

You need to use the uri of the splunkd, not the splunkweb.

Instead you should run:

./splunk search bob -uri https://dsc-splunksearch-01:8089 -auth <....>

And to verify, look at splunkd_access.log.