Getting Data In

Exporting results from api search

jmadsen1
Explorer

Hello, I am trying to export the results from an api search, currently I am using the curl command: 

curl -k -u user:pass https://hostname:8089/services/search/jobs/export?search=$NewQ -o Output-file.csv

I can see that the search completed in the splunk webclient but am not able to find the output csv file that should result from this command. I have checked the $SPLUNK_HOME/var/run/splunk/csv folder after each attempt at using this command and there has never been a file created there (which to my understanding is where this file is supposed to be created). Any help is greatly appreciated 🙂 thank you.

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Wait a second. Where are you looking for the results file? On splunk server? If you're calling curl with -o option, you'll get an output file on your local computer - the one calling curl.

BTW, calling API this way might not be the best way if the search produces big result set.

0 Karma

jmadsen1
Explorer

In my testing environment the PC I am executing the Curl command from is the acting splunk server, yet no files are created when I check that file mentioned file path

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Of you run the curl command without the -o switch, do you get any results on the terminal?

0 Karma

jmadsen1
Explorer

Without the -o switch the curl command returns a large set of data for all the results of the search, which is what I am trying to export to the csv file in question that will not generate.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The -o switch simply causes curl to write server's output (which is otherwise printed on screen) to a file. So unless you have some local issues, like insufficient permissions in the directory you're calling curl from to write a file ther, there has to be a file created with the output. If you're running this curl from unix/linux box remember that the filenames are case-sensitive, so if you wrote Output.csv and look for outout.csv, you won't find it - these are two different files.

0 Karma

Gr0und_Z3r0
Contributor

Try something like this....

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal 
| head 3" -d output_mode=csv/xml/json

This will store the results in the user path as shown below.

Gr0und_Z3r0_0-1638577277787.png

 

 

0 Karma

jmadsen1
Explorer

Thank you for the response, I have tried several variations on your suggested solution and this curl command still doesn't seems to produce any exported files of any type on my system. Is there anywhere this file could be generated that is not this directory? is there preliminary steps to take to get it to generate at all?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...