topic Re: using curl to run REST_API in linux do not return fields in Splunk Search

using curl to run REST_API in linux do not return fields

ssaenger — Wed, 27 Feb 2019 12:21:32 GMT

Hi All,

i am trying to use Curl to return a search as my result will be >6million to a csv file.
using the command:

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | table subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

this returns the below to filename.csv:

subid,cardid,panelid
,,
,,
,,
,,
,,

If i take the table request out and use the fields:

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | fields subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

This returns the whole log line below to filename.csv:

"2019-02-27 11:49:37.772 GMT","2019/02/27 11:49:37.772 [SenderFile] [c-11]:   INFO:  Report saved to /apps/box_20190227114937772_77777740_5_892222_1223.xml"

In this instance the fields i am trying to put into a table are:

subid 77777740
cardid 892222
panelid 5

When i include table to extract the fields, I don't get anything returned:

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | fields subid cardid panelid |table subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

any advice would be grateful.
Thanks.

Re: using curl to run REST_API in linux do not return fields

woodcock — Sun, 03 Mar 2019 02:49:27 GMT

What happens when you do this?

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | table subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

Re: using curl to run REST_API in linux do not return fields

DavidHourani — Sun, 03 Mar 2019 03:46:02 GMT

Hi @ssaenger,

Have you verified that your field extraction is working properly and that their permissions are not set to private ?

Could you please share that config ?

Cheers,
David

Re: using curl to run REST_API in linux do not return fields

ssaenger — Mon, 04 Mar 2019 09:29:11 GMT

Hi David,

It was a permissions state.
thank you.

Re: using curl to run REST_API in linux do not return fields

woodcock — Wed, 06 Mar 2019 06:34:04 GMT

OK, so post the specifics as a new answer and click Accept on that answer to close the question.

Re: using curl to run REST_API in linux do not return fields

DavidHourani — Wed, 06 Mar 2019 14:25:55 GMT

You're welcome ! Feel free to accept the answer 😄