Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@halr9000
Created September 18, 2013 04:27
Show Gist options
  • Star 12 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save halr9000/6604542 to your computer and use it in GitHub Desktop.
Save halr9000/6604542 to your computer and use it in GitHub Desktop.
Splunk export search job using PowerShell
# Conversion of http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2Fexport
# example using curl, to PowerShell with Invoke-RestMethod cmdlet
#
# $ curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export
# --data-urlencode search="search index=_internal | stats count by sourcetype"
# -d output_mode=json -d earliest="rt-5m" -d latest="rt"
$cred = Get-Credential
# This will allow for self-signed SSL certs to work
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$server = 'server.company.com'
$url = "https://${server}:8089/services/search/jobs/export" # braces needed b/c the colon is otherwise a scope operator
$search = "search index=_internal | stats count by sourcetype" # Cmdlet handles urlencoding
$body = @{
search = $search
output_mode = "json"
earliest_time = "rt-5m"
latest_time = "rt"
}
Invoke-RestMethod -Method Post -Uri $url -Credential $cred -Body $body
@vandelin586
Copy link

i would like to search a saved search or input a splunk query using powershell , can anyone help?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment