Getting Data In

Exporting results from api search

jmadsen1
Explorer

Hello, I am trying to export the results from an api search, currently I am using the curl command: 

curl -k -u user:pass https://hostname:8089/services/search/jobs/export?search=$NewQ -o Output-file.csv

I can see that the search completed in the splunk webclient but am not able to find the output csv file that should result from this command. I have checked the $SPLUNK_HOME/var/run/splunk/csv folder after each attempt at using this command and there has never been a file created there (which to my understanding is where this file is supposed to be created). Any help is greatly appreciated 🙂 thank you.

Labels (4)
0 Karma

PickleRick
Champion

Wait a second. Where are you looking for the results file? On splunk server? If you're calling curl with -o option, you'll get an output file on your local computer - the one calling curl.

BTW, calling API this way might not be the best way if the search produces big result set.

0 Karma

jmadsen1
Explorer

In my testing environment the PC I am executing the Curl command from is the acting splunk server, yet no files are created when I check that file mentioned file path

0 Karma

PickleRick
Champion

Of you run the curl command without the -o switch, do you get any results on the terminal?

0 Karma

jmadsen1
Explorer

Without the -o switch the curl command returns a large set of data for all the results of the search, which is what I am trying to export to the csv file in question that will not generate.

0 Karma

PickleRick
Champion

The -o switch simply causes curl to write server's output (which is otherwise printed on screen) to a file. So unless you have some local issues, like insufficient permissions in the directory you're calling curl from to write a file ther, there has to be a file created with the output. If you're running this curl from unix/linux box remember that the filenames are case-sensitive, so if you wrote Output.csv and look for outout.csv, you won't find it - these are two different files.

0 Karma

Gr0und_Z3r0
Path Finder

Try something like this....

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal 
| head 3" -d output_mode=csv/xml/json

This will store the results in the user path as shown below.

Gr0und_Z3r0_0-1638577277787.png

 

 

0 Karma

jmadsen1
Explorer

Thank you for the response, I have tried several variations on your suggested solution and this curl command still doesn't seems to produce any exported files of any type on my system. Is there anywhere this file could be generated that is not this directory? is there preliminary steps to take to get it to generate at all?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!