Try using this uri: https://<host>:<mPort>/services/search/v2/jobs/ The api uri that you are using is depricated. To my knowledge, it deletes the "|" in the beginning of the SPL query, that's why you got the error "Error in 'makeresults' command: This command must be the first command of a search.".  What splunk receives from your query "search | makeresults | eval nombre=\"denis\"" with api call is this: makeresults | eval nombre="denis" AND NOT | makeresults | eval nombre="denis" https://docs.splunk.com/Documentation/Splunk/9.2.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fresults ... View more