Equivalent Splunk UI query: Working well
source=/abc/log/* earliest="11/19/2018:08:00:00" latest="11/19/2018:18:00:00" | eval rawlen=len(raw) | eval rawlengb = rawlen/1024/1024/1024 | stats sum(rawlen_gb) as GB by source, host | sort - GB
Rest API Usage?
I've tried the below curl command via REST API but didn't get same log sizes as in splunk UI query.
curl -vu user:pass -d outputmode=csv -o /home/someuser/output.csv -k https://organisation.fmr.com/servicesNS/admin/search/search/jobs/export -d search='search earliest="11/19/2018:08:00:00" latest="11/19/2018:18:00:00" group=persourcethruput series=/abc/log/* | eval rawlen=len(raw) | eval rawlengb = rawlen/1024/1024/1024 | stats sum(rawlengb) as GB by series | sort - GB'
Results from Splunk UI are 100-1000% greater than results from the Curl via REST API.
Can someone please help me with the correct REST API usage to get the same results as given by splunk UI query.
