Exporting results from api search

[jmadsen1]

Hello, I am trying to export the results from an api search, currently I am using the curl command: 

curl -k -u user:pass https://hostname:8089/services/search/jobs/export?search=$NewQ -o Output-file.csv

I can see that the search completed in the splunk webclient but am not able to find the output csv file that should result from this command. I have checked the $SPLUNK_HOME/var/run/splunk/csv folder after each attempt at using this command and there has never been a file created there (which to my understanding is where this file is supposed to be created). Any help is greatly appreciated 🙂 thank you.

[PickleRick]

Wait a second. Where are you looking for the results file? On splunk server? If you're calling curl with -o option, you'll get an output file on your local computer - the one calling curl.

BTW, calling API this way might not be the best way if the search produces big result set.

[jmadsen1]

In my testing environment the PC I am executing the Curl command from is the acting splunk server, yet no files are created when I check that file mentioned file path

[PickleRick]

Of you run the curl command without the -o switch, do you get any results on the terminal?

[jmadsen1]

Without the -o switch the curl command returns a large set of data for all the results of the search, which is what I am trying to export to the csv file in question that will not generate.

[PickleRick]

The -o switch simply causes curl to write server's output (which is otherwise printed on screen) to a file. So unless you have some local issues, like insufficient permissions in the directory you're calling curl from to write a file ther, there has to be a file created with the output. If you're running this curl from unix/linux box remember that the filenames are case-sensitive, so if you wrote Output.csv and look for outout.csv, you won't find it - these are two different files.

[Gr0und_Z3r0]

Try something like this....

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal 
| head 3" -d output_mode=csv/xml/json

This will store the results in the user path as shown below.

[jmadsen1]

Thank you for the response, I have tried several variations on your suggested solution and this curl command still doesn't seems to produce any exported files of any type on my system. Is there anywhere this file could be generated that is not this directory? is there preliminary steps to take to get it to generate at all?