Getting Data In

Exporting search to csv contains headers, exporting with cURL/API does not

sanorthrup
Path Finder

Is there any way to add headers to the csv output I retrieve from curl? I'm getting them in the gui, but I can't figure out how to get these included through the api.

Tags (4)
1 Solution

dart
Splunk Employee
Splunk Employee

Can you post your curl request?

This works for me:

curl  -k -u admin:changeme  -d 'search="search *   |  head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export

"_serial","_time",source,sourcetype,host,index,"splunk_server","_raw"
0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623"

View solution in original post

dart
Splunk Employee
Splunk Employee

Can you post your curl request?

This works for me:

curl  -k -u admin:changeme  -d 'search="search *   |  head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export

"_serial","_time",source,sourcetype,host,index,"splunk_server","_raw"
0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623"

sanorthrup
Path Finder

table * is what I was missing. Thank you so much.

0 Karma

dart
Splunk Employee
Splunk Employee

One way to do this is to run this search:
search * | table *| head 10

0 Karma

sanorthrup
Path Finder

Ok, it looks like you're actually getting the same thing as me. All of your raw data is in quotes, so it shows up as one huge field. When doing an export through the gui it strips the quotes and parses the headers to each field, then includes them in the csv.
My query is this:
curl -k -u user:pass -d "output_mode=csv" -d "search=| savedsearch sslvpn1d | head 10" -d earliest_time="-1d@d" -d latest_time="-0d@d" https://splunkserver:8089/services/search/jobs/export

Is there some way to have Splunk parse out the interesting fields thru the API the same way that it does thru the GUI?

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...