topic Re: How to get kvstore data using Splunk's REST API in CSV format? in Getting Data In

How to get kvstore data using Splunk's REST API in CSV format?

harshal_chakran — Tue, 29 Oct 2019 10:56:55 GMT

Hi,
Is there any way I can get the kvstore data in csv format by using the REST API command via curl?

Following is the curl command I am using but the output is coming in json format. I tried output_mode=csv, but it's giving an error.

curl -k -u <uname>:<pwd> https://<hostname>:8089/servicesNS/nobody/<appName>/storage/collections/data/<collectionName>;

Thanks in advance.

Re: How to get kvstore data using Splunk's REST API in CSV format?

jkat54 — Tue, 29 Oct 2019 12:53:41 GMT

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

Re: How to get kvstore data using Splunk's REST API in CSV format?

harshal_chakran — Fri, 20 Dec 2019 12:50:29 GMT

Thanks, this helped me to resolve this.
So my final curl command came in as :

curl -k -u <uname>:<pwd>  https://<hotsname>:8089/servicesNS/admin/<appName>/search/jobs/export -d search="|inputlookup <kvstoreName>| table field1, field2, field3" -d output_mode=csv