https://community.splunk.com/t5/Getting-Data-In/services-search-jobs-export-ignores-required-fields-in-CSV/m-p/30082#M5222 <P>I think I made progress. The API is very very picky as to the order of piped commands...</P> <P>After many many permutations this got me somewhere:</P> <P>search * | head 10 | table _time,mycolumn1,event_code,from_ip,from_port</P> <P>The CSV output is still not honoring the field order (I did try to pipe it to the 'fields' command, which didn't affect CSV output still). So, _time column is somewhere in the middle of the output, and not the first one. I'll try reformatting it, maybe it will agree to behave better when treated as a custom field <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Another issue is the string values for columns are wrapped in double quotes, which seems really redundant when there's no need for that at all (e.g. simple values).</P> Mon, 28 Sep 2020 13:52:51 GMT aperepel 2020-09-28T13:52:51Z https://community.splunk.com/t5/Getting-Data-In/services-search-jobs-export-ignores-required-fields-in-CSV/m-p/30081#M5221 <P>The doc for the /jobs/export mentions the 'rf' parameter (v5.0.2). However, it is ignored by the REST endpoint. E.g. for this URL: <A href="https://example.com/services/search/jobs/export?search=search+*+index%3D%22somename%22++%7C+head+50&amp;output_mode=csv&amp;rf=event_code">https://example.com/services/search/jobs/export?search=search+*+index%3D%22somename%22++%7C+head+50&amp;output_mode=csv&amp;rf=event_code</A></P> <P>I expect it to return an event_code field, but it just dumps raw set of meta fields (host, time, _raw, etc.). NONE of the actual extracted fields which work great in the UI.</P> <P>How can I set up the CSV export to contain only the fields I want?</P> Fri, 10 May 2013 17:07:42 GMT https://community.splunk.com/t5/Getting-Data-In/services-search-jobs-export-ignores-required-fields-in-CSV/m-p/30081#M5221 aperepel 2013-05-10T17:07:42Z https://community.splunk.com/t5/Getting-Data-In/services-search-jobs-export-ignores-required-fields-in-CSV/m-p/30082#M5222 <P>I think I made progress. The API is very very picky as to the order of piped commands...</P> <P>After many many permutations this got me somewhere:</P> <P>search * | head 10 | table _time,mycolumn1,event_code,from_ip,from_port</P> <P>The CSV output is still not honoring the field order (I did try to pipe it to the 'fields' command, which didn't affect CSV output still). So, _time column is somewhere in the middle of the output, and not the first one. I'll try reformatting it, maybe it will agree to behave better when treated as a custom field <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Another issue is the string values for columns are wrapped in double quotes, which seems really redundant when there's no need for that at all (e.g. simple values).</P> Mon, 28 Sep 2020 13:52:51 GMT https://community.splunk.com/t5/Getting-Data-In/services-search-jobs-export-ignores-required-fields-in-CSV/m-p/30082#M5222 aperepel 2020-09-28T13:52:51Z