I get this error after executing it as the blog says: | rest splunk_server=socsiemfe /services/search/jobs/export search="| inputlookup licencia.csv" output_mode=csv | fields value [socsiemfe] Unable to determine response format from HTTP Header ... View more

I have SH socsiemfe as a search peer. But what is not clear to me is that your original query is expected to work, if when I run the first line it returns nothing. When you build a query, you test it as you go along. First part 1 should work, then part 2, then part 3. If one part of the query does not return data, why then are we going to create a macro if part 1 does not return anything. Do you understand my doubt? ... View more

I did exactly what you put in your final query and I get error: | rest splunk_server=socsiemfe /services/search/jobs/export search="| inputlookup license.csv" output_mode=csv [socsiemfe] Unable to determine response format from HTTP Header ... View more

Let's see, let's do something. Run only the first part of your query: rest splunk_server=$server$ /services/search/jobs/export search="| inputlookup $lookup$ Does it work for you? It should work for you, right? ... View more

So, how is your method going to work if you are also using REST. ... View more

Splunk documentation states that the services/search/jobs/export method is no longer supported as of version 9.0.0. ... View more

In my case, I get an error because this query: | rest splunk_server=socsiemfe /services/search/v2/jobs/export search="| inputlookup licencia.csv" I am querying a lookup of a SH from another SH. I'm not even using a macro. ... View more

I get this error: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/search/v2/jobs/export?count=0&search=%7C%20inputlookup%20licencia.csv from server=https://127.0.0.1:8089 - Method Not Allowed   ... View more

Your proposal looks interesting, but it doesn't work. I have Splunk 9.0.1 and I get an error. ... View more