I'd like to query splunk via a single REST call. mostly because I'm trying to get data from excel via data > import external data > webquery
I've tried the following urls from my browser without any success can someone suggest the right REST call please
test my search qeury is valid https://localhost:8089/servicesNS/admin/search/search/jobs?search="search index=_internal | head 5" <this works=""> https://localhost:8089/servicesNS/admin/search/search/jobs/1367167143.141/results?count=5<calling this="" gets="" the="" results="" fine="">
<msg type="FATAL">Error in 'SearchParser': Missing a search command before '"'.</msg> https://localhost:8089/servicesNS/admin/search/search/jobs/export?exec_mode=oneshot&search="search index=_internal | head 5"
<msg type="FATAL">Empty search.</msg> https://localhost:8089/servicesNS/admin/search/search/jobs/export