topic Exporting results from api search in Getting Data In

Exporting results from api search

jmadsen1 — Thu, 02 Dec 2021 19:41:37 GMT

Hello, I am trying to export the results from an api search, currently I am using the curl command:

curl -k -u user:pass https://hostname:8089/services/search/jobs/export?search=$NewQ -o Output-file.csv

I can see that the search completed in the splunk webclient but am not able to find the output csv file that should result from this command. I have checked the $SPLUNK_HOME/var/run/splunk/csv folder after each attempt at using this command and there has never been a file created there (which to my understanding is where this file is supposed to be created). Any help is greatly appreciated 🙂 thank you.

Re: Exporting results from api search

Gr0und_Z3r0 — Sat, 04 Dec 2021 00:21:52 GMT

Try something like this....

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal | head 3" -d output_mode=csv/xml/json

This will store the results in the user path as shown below.

Re: Exporting results from api search

jmadsen1 — Mon, 06 Dec 2021 14:15:32 GMT

Thank you for the response, I have tried several variations on your suggested solution and this curl command still doesn't seems to produce any exported files of any type on my system. Is there anywhere this file could be generated that is not this directory? is there preliminary steps to take to get it to generate at all?

Re: Exporting results from api search

PickleRick — Mon, 06 Dec 2021 15:23:17 GMT

Wait a second. Where are you looking for the results file? On splunk server? If you're calling curl with -o option, you'll get an output file on your local computer - the one calling curl.

BTW, calling API this way might not be the best way if the search produces big result set.

Re: Exporting results from api search

jmadsen1 — Mon, 06 Dec 2021 16:18:59 GMT

In my testing environment the PC I am executing the Curl command from is the acting splunk server, yet no files are created when I check that file mentioned file path

Re: Exporting results from api search

PickleRick — Mon, 06 Dec 2021 17:58:20 GMT

Of you run the curl command without the -o switch, do you get any results on the terminal?

Re: Exporting results from api search

jmadsen1 — Mon, 06 Dec 2021 18:23:23 GMT

Without the -o switch the curl command returns a large set of data for all the results of the search, which is what I am trying to export to the csv file in question that will not generate.

Re: Exporting results from api search

PickleRick — Mon, 06 Dec 2021 18:52:01 GMT

The -o switch simply causes curl to write server's output (which is otherwise printed on screen) to a file. So unless you have some local issues, like insufficient permissions in the directory you're calling curl from to write a file ther, there has to be a file created with the output. If you're running this curl from unix/linux box remember that the filenames are case-sensitive, so if you wrote Output.csv and look for outout.csv, you won't find it - these are two different files.