Splunk search Using CURL is not working

manoharkalva — Wed, 16 Dec 2020 10:14:08 GMT

Hi,

Below used query is working perfectly fine when i searched directly in SPLUNK WEB. but when i use the same query in CURL it's not working. I can able to run basic search using CURL but not this query. Kindly help me on this.

Here is the query i used:

curl -k -u UserName:Passwd https://splunkurl:port/services/search/jobs/export --data-urlencode search="search cs_uri_stem="*/reporting/wkReport.xls" AND (cs_uri_query="reportName=Pay+Certification" OR cs_uri_query="reportName=CS+Monthly+Payroll+Cost*")|stats count by AssociateOID, OrgOID, date, o, reportName" -d output_mode=csv

Output shows FATEL error.

I removed double qoutes with single quotes in search string and it gives me different error.

query: curl -k -u UserName:Passwd https://splunkurl:port/services/search/jobs/export --data-urlencode search="search cs_uri_stem="*/reporting/wkReport.xls" AND (cs_uri_query="reportName=Pay+Certification" OR cs_uri_query="reportName=CS+Monthly+Payroll+Cost*")|stats count by AssociateOID, OrgOID, date, o, reportName" -d output_mode=csv

Output shows stats is not recognized as internal/external command.

Kindly help me out on this.

Re: Splunk search Using CURL is not working

harsmarvania57 — Wed, 16 Dec 2020 13:26:14 GMT

Hi,

You need to escape double quote, please use below curl command and it will work fine.

curl -k -u user:pass https://server:port/services/search/jobs/export --data-urlencode search="search cs_uri_stem=\"*/reporting/wkReport.xls\" AND (cs_uri_query=\"reportName=Pay+Certification\" OR cs_uri_query=\"reportName=CS+Monthly+Payroll+Cost*\")|stats count by AssociateOID, OrgOID, date, o, reportName" -d output_mode=csv

topic Re: Splunk search Using CURL is not working in Splunk Search

Splunk search Using CURL is not working

Re: Splunk search Using CURL is not working