I can't find documentation anywhere on how to format search strings for the Splunk SDK. Every single example provided just uses:
search index=_internal | head 10
I'm just trying to search on a custom field I use in my application, so I thought this would work:
search index=myindex mycustomfield=xyz
but that just gives me an error: Bad Request: FATAL: Unknown search command mycustomfield
How do I format this as I want? And perhaps more importantly where is this documented how the SDK expects requests to be formatted?
... View more