I get this error after executing it as the blog says: | rest splunk_server=socsiemfe /services/search/jobs/export search="| inputlookup licencia.csv" output_mode=csv | fields value [socsiemfe] Unable to determine response format from HTTP Header
... View more
I have SH socsiemfe as a search peer. But what is not clear to me is that your original query is expected to work, if when I run the first line it returns nothing. When you build a query, you test it as you go along. First part 1 should work, then part 2, then part 3. If one part of the query does not return data, why then are we going to create a macro if part 1 does not return anything. Do you understand my doubt?
... View more
I did exactly what you put in your final query and I get error: | rest splunk_server=socsiemfe /services/search/jobs/export search="| inputlookup license.csv" output_mode=csv [socsiemfe] Unable to determine response format from HTTP Header
... View more
Let's see, let's do something. Run only the first part of your query: rest splunk_server=$server$ /services/search/jobs/export search="| inputlookup $lookup$ Does it work for you? It should work for you, right?
... View more
In my case, I get an error because this query: | rest splunk_server=socsiemfe /services/search/v2/jobs/export search="| inputlookup licencia.csv" I am querying a lookup of a SH from another SH. I'm not even using a macro.
... View more
I get this error: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/search/v2/jobs/export?count=0&search=%7C%20inputlookup%20licencia.csv from server=https://127.0.0.1:8089 - Method Not Allowed
... View more