Solved issue -- based on the structure of the query, I was expecting search to be a KV parameter passed in through the data field of the POST query. Rather, the splunk search syntax should be preserved as the full string, with that passed in as the POST body, e.g.
r = requests.post("<host>/services/search/jobs",headers={"Authorization":"Splunk {}".format(sessionkey)},data="search = | dbxquery query=\"SELECT * FROM mx.mx.institutions\" connection=\"MXProd\"",params={"output_mode":"json"})
which works as expected.
... View more