Example of synchronous search in Splunk with default output in JSON

splunk_synch_search

#!/bin/bash
SERVER="https://splunk_server:8089"
QUERY="search sourcetype=dhcp earliest=-4h"
SEARCH_URI="services/search/jobs/export"

RESULTS=$(curl -s -k "$SERVER/$SEARCH_URI" --data-urlencode search="$QUERY" -d output_mode=json)
echo $RESULTS