topic Download raw Splunk logs via api in Splunk Enterprise

Download raw Splunk logs via api

vj_hawk21 — Thu, 15 Oct 2020 04:20:21 GMT

Team,

how to remotely execute a search and download the search results and store in a shared drive or a CSV file.

Re: Download raw Splunk logs via api

rnowitzki — Thu, 15 Oct 2020 09:07:51 GMT

Hi @vj_hawk21,

Please check the documentation about the REST API:

https://docs.splunk.com/Documentation/Splunk/8.0.6/RESTTUT/RESTsearches

You create a search job, get the sid back and with the sid you can get the results.

To receive the results as csv, you would have to use output_mode=csv as indicated here.

BR
Ralph

Re: Download raw Splunk logs via api

vj_hawk21 — Thu, 15 Oct 2020 18:02:45 GMT

Hi @rnowitzki

Thanks for your response.

I have created the search but not able to find its sid/vsid/searc_id.. how to identify the SID?

Thx

Re: Download raw Splunk logs via api

rnowitzki — Fri, 16 Oct 2020 07:24:30 GMT

Hi @vj_hawk21 ,

When you created the Job, the sid was in the response.

Also, you can get a list of your searches with

curl -u admin:changeme -k https://localhost:8089/services/search/jobs/

BR
Ralph