topic Exporting search to csv contains headers, exporting with cURL/API does not in Getting Data In

Exporting search to csv contains headers, exporting with cURL/API does not

sanorthrup — Tue, 30 Apr 2013 17:31:33 GMT

Is there any way to add headers to the csv output I retrieve from curl? I'm getting them in the gui, but I can't figure out how to get these included through the api.

Re: Exporting search to csv contains headers, exporting with cURL/API does not

dart — Tue, 30 Apr 2013 19:01:55 GMT

Can you post your curl request?

This works for me:

curl  -k -u admin:changeme  -d 'search="search *   |  head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export

"_serial","_time",source,sourcetype,host,index,"splunk_server","_raw"
0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623"

Re: Exporting search to csv contains headers, exporting with cURL/API does not

sanorthrup — Mon, 28 Sep 2020 13:48:35 GMT

Ok, it looks like you're actually getting the same thing as me. All of your raw data is in quotes, so it shows up as one huge field. When doing an export through the gui it strips the quotes and parses the headers to each field, then includes them in the csv.
My query is this:
curl -k -u user:pass -d "output_mode=csv" -d "search=| savedsearch sslvpn1d | head 10" -d earliest_time="-1d@d" -d latest_time="-0d@d" https://splunkserver:8089/services/search/jobs/export

Is there some way to have Splunk parse out the interesting fields thru the API the same way that it does thru the GUI?

Re: Exporting search to csv contains headers, exporting with cURL/API does not

dart — Tue, 30 Apr 2013 19:25:34 GMT

One way to do this is to run this search:
search * | table *| head 10

Re: Exporting search to csv contains headers, exporting with cURL/API does not

sanorthrup — Tue, 30 Apr 2013 19:46:17 GMT

table * is what I was missing. Thank you so much.