First attempt creates the splunk SID, but fails on the successive attempts to create search id. Same issue occurs while polling/consuming the search after SID creation on its successive attempts. Can anybody point out helping the missing part?
Curl query used :
curl -H 'Authorization:Splunk sessionkeyincluded' https://hostname:60659/services/search/jobs -d search="search sourcetype=\"xx:yy\" earliest=\"03/19/2018:07:00:00\" latest=\"03/19/2018:07:15:00\" | stats count"
<?xml version="1.0" encoding="UTF-8"?>
<response>
<sid>1522168074.7125_E472E7F2-9BEF-4117-A49A-8281B171EF1E</sid>
</response>
successive attempts fails with authentication failure mentioning "call not properly authenticated"
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="WARN">call not properly authenticated</msg>
</messages>
</response>
