Splunk rest api services/search/v2/jobs/export to search multiline command

[gopal]

Hi ,

i am trying to execute multiline splunk commands as below using rest endpoint

services/search/v2/jobs/export

 https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2Fexport

search command :

| inputlookup some_inputlokupfile.csv

| rename user as CUSTOMER,  zone as REGION, "product"  as PRODUCT_ID

| fields CUSTOMER*, PRODUCT_ID

| outputlookup some_example_generated_file.csv.gz override_if_empty=false

when i execute the curl it returns success 200 but file is not created.

is it possible to invoke multiline search command using pipe with this or any other search api?

the search is dynamic i cant create savedsearch and execute.

[marnall]

Are you able to generate the some_example_generated_file.csv.gz file from running the search in the Splunk webUI as the user whose credentials or token is being used to authorize the API request?

There should be no problem running searches with piped segments using curl and the search api endpoints. Though you may have to tweak the character encoding in the search query. I recommend trying it segment-by-segment to see if it generates the expected results.

[isoutamo]

Hi

you could write “multi line” searches separated by | on one line. In normal situation there is no mater have you written SPL in one line or formatting it to several lines. It’s just for reading it easier.

You could also write your query as a report and then call it with savedsearch your report via rest.

r. Ismo