Exporting search to csv contains headers, exporting with cURL/API does not

[sanorthrup]

Is there any way to add headers to the csv output I retrieve from curl? I'm getting them in the gui, but I can't figure out how to get these included through the api.

[dart · Accepted solution]

Can you post your curl request?

This works for me:

curl  -k -u admin:changeme  -d 'search="search *   |  head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export

"_serial","_time",source,sourcetype,host,index,"splunk_server","_raw"
0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623"

[sanorthrup]

table * is what I was missing. Thank you so much.

[dart]

One way to do this is to run this search:
search * | table *| head 10

[sanorthrup]

Ok, it looks like you're actually getting the same thing as me. All of your raw data is in quotes, so it shows up as one huge field. When doing an export through the gui it strips the quotes and parses the headers to each field, then includes them in the csv.
My query is this:
curl -k -u user:pass -d "output_mode=csv" -d "search=| savedsearch sslvpn1d | head 10" -d earliest_time="-1d@d" -d latest_time="-0d@d" https://splunkserver:8089/services/search/jobs/export

Is there some way to have Splunk parse out the interesting fields thru the API the same way that it does thru the GUI?