I have a search that runs within Splunk, but when I try it via curl, I get an error. Hoping someone can help me...
Here's the command:
curl -k -u user:passwd --data-urlencode search="search index=coreops sourcetype=sitescopemonitorstat MonitorType=FileSystem remotehost=artp17 OR remotehost=artp21 OR remotehost=artp22 OR remotehost=artp23 OR remotehost=artp24 OR remotehost=artp25 OR remotehost=artp26 AND (FSName = "/fii" OR FS_Name = "/dis") earliest=-15m |dedup remotehost, FSName |eval FSPercUsed=rtrim(Use,"%") |where FSPercUsed > 50 |table _time, remotehost, FSName, FS_PercUsed" https://artp449:8089/servicesNS/admin/search/search/jobs/export
When I execute this, I get:
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type="FATAL">Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%)'.</msg></messages></response>$
It would be useful if you put the curl line and XML response in a Code Sample block instead of the way you have here, but based on what is visible here, it looks like you're not escaping the double-quotes on the inside of the search string. That will almost certainly cause issues.