I'm having this exact issue, I dont have admin rights to be cloning stuff into the search context, that is if this is what you did to resolve this. Is there anyway in powershell i can change my "app" ... View more

I don't know why it formatted it like this, but, it is what it is ... View more

i was just mentioning that my curl command had --insecure because it will throw ssl errors at you and not run if you dont because the site is not trusted/has an ssl cert Skipping certs is just one line that I already have [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true } But I'm to form the entire 10 other lines, i cant find a good example to work with when exporting a saved search $search=""https://api.splunk.company.com:443/services/search/jobs/scheduler__username_c3NlX3NpdGVzY29wZV9wcm9kX3YwMQ__usernameapisearchv3_at_1590751800_36332_8CEC1426-6D01-4FD1-8F3C-31B0C726D471/results?count=0" <-- im trying to do something like this #$search = $servar # Cmdlet handles urlencoding $body = @{ search = $search output_mode = "json" earliest_time = "-31d" latest_time = "-5d" } Invoke-RestMethod -Method get -Uri $url -Credential $cred -Body $body Regards, ... View more

I appreciate the response. I just can't seem to get the entire invoke-restmethod command down pat I can work with the cert issue , i see where you can search splunk with invoke-restmethod. I want to be able to have powershell invoke-restmethod and export a saved search ... View more

In the end i want the history for the sid and then i want to call: curl --insecure -u username "https://api.splunk.company.com:443/services/search/jobs/Enter sid/results?count=0" ... View more

This is how I got mine to work, not sure the difference between mine and yours, but this worked for me curl -k -u 'username:password' "https://api.company.com:443/services/search/jobs/$sidkey/results?count=0&output_mode=csv" my sidkey is just the sid within a variable , change it to a valid sid ... View more

I would like to know how you send the curl history command on a saved search and then capture just the SID and then have it execute a {sid}/results, all in one shot , i know its a two step process but to automate this I will need to run history capture SID then run results on the SID. Any thoughts ... View more