Getting Data In

Exporting search to csv contains headers, exporting with cURL/API does not

sanorthrup
Path Finder

Is there any way to add headers to the csv output I retrieve from curl? I'm getting them in the gui, but I can't figure out how to get these included through the api.

Tags (4)
1 Solution

dart
Splunk Employee
Splunk Employee

Can you post your curl request?

This works for me:

curl  -k -u admin:changeme  -d 'search="search *   |  head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export

"_serial","_time",source,sourcetype,host,index,"splunk_server","_raw"
0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623"

View solution in original post

dart
Splunk Employee
Splunk Employee

Can you post your curl request?

This works for me:

curl  -k -u admin:changeme  -d 'search="search *   |  head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export

"_serial","_time",source,sourcetype,host,index,"splunk_server","_raw"
0,"2013-04-30 19:59:04.105 BST","/opt/apache/log/sl_access_combined.log","sl_access_combined","example.splunk.com","example","splunk.example.com","1.2.3.4 - - [30/Apr/2013 18:59:04:105] ""POST /url HTTP 1.1"" 503 878 ""http://example.com/referer"" ""Googlebot/2.1 ( http://www.googlebot.com/bot.html) "" 623"

sanorthrup
Path Finder

table * is what I was missing. Thank you so much.

0 Karma

dart
Splunk Employee
Splunk Employee

One way to do this is to run this search:
search * | table *| head 10

0 Karma

sanorthrup
Path Finder

Ok, it looks like you're actually getting the same thing as me. All of your raw data is in quotes, so it shows up as one huge field. When doing an export through the gui it strips the quotes and parses the headers to each field, then includes them in the csv.
My query is this:
curl -k -u user:pass -d "output_mode=csv" -d "search=| savedsearch sslvpn1d | head 10" -d earliest_time="-1d@d" -d latest_time="-0d@d" https://splunkserver:8089/services/search/jobs/export

Is there some way to have Splunk parse out the interesting fields thru the API the same way that it does thru the GUI?

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...