Splunk export search job using PowerShell

Export-SplunkSearch.ps1

# Conversion of http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2Fexport 
# example using curl, to PowerShell with Invoke-RestMethod cmdlet
#
# $ curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export 
#        --data-urlencode search="search index=_internal | stats count by sourcetype" 
#        -d output_mode=json -d earliest="rt-5m" -d latest="rt"

$cred = Get-Credential

# This will allow for self-signed SSL certs to work
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

$server = 'server.company.com'
$url = "https://${server}:8089/services/search/jobs/export" # braces needed b/c the colon is otherwise a scope operator
$search = "search index=_internal | stats count by sourcetype" # Cmdlet handles urlencoding
$body = @{
    search = $search
    output_mode = "json"
    earliest_time = "rt-5m"
    latest_time = "rt"
}
Invoke-RestMethod -Method Post -Uri $url -Credential $cred -Body $body

Needs to be parameterized. This was a quick one.

Your blog post mentions not to do real time (never ends), but in this snippet you have it.
Might be worth updating.

Thanks for the comment @fontora. That was intentional as this was a literal translation based on an example in the Splunk docs which itself uses real-time for whatever weird reason.

Also, heck of a call back!

Fair enough.

Doing a Windows deployment and came across the old blog post and in turn here.
Beat my head against the keyboard until I reread your post and fixed the RT issue :)

i would like to search a saved search or input a splunk query using powershell , can anyone help?