Getting Data In

How do I find the results for the cli search that output_mode is csv

Communicator

Hello

I have a curl command that runs a saved search and uses output_mode=csv .

What I need to know is where do I get the results from?

Here's the command:

curl -k -u "xxsnypr:xxxxxxx" -L https://splunk.ourdomain.com:8089/services/search/jobs/export -d search=" savedsearch Bluecoat" -d output_mode=csv

Thanks!

0 Karma
1 Solution

Builder

Add a -o to your command for "output", then the full path to where you want it.
Example: curl -k -u "xxsnypr:xxxxxxx" -L https://splunk.ourdomain.com:8089/services/search/jobs/export -d search=" savedsearch Bluecoat" -d output_mode=csv -o \var\temp\splunkresults_bluecoat.csv

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

Communicator

Gave the Answer to the above because that was the answer to where the file was going or how to create the file in a specific path.

I got this to work BUT what I had to do was edit my saved search. I changed my saved search to

 | table * | fields <fields I wanted>

once I did that and ran the API command again:

curl -k -u "xxsnypr:XXXXXXXXX" -L https://splunk.mydoamin.com:8089/services/search/jobs/export -d search="savedsearch SnyprBlueCoat" -d output_mode=csv -o /home/splunk/test2.csv

I got my csv results. The underlying issue was the saved search's syntax, for some reason it didnt like the:

search to get data| table <fields I want>
0 Karma

Builder

Add a -o to your command for "output", then the full path to where you want it.
Example: curl -k -u "xxsnypr:xxxxxxx" -L https://splunk.ourdomain.com:8089/services/search/jobs/export -d search=" savedsearch Bluecoat" -d output_mode=csv -o \var\temp\splunkresults_bluecoat.csv

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

Communicator

Hello

When I do this the report seems to start running and then it jsut drops me back to the command prompt and never creates the .csv file

[me@myhost00 ~]$ curl -k -u "xxsnypr:xxxxxxxx" -L https://splunk.ourdomain.com:8089/services/search/jobs/export -d search=" savedsearch Snypr1" -d output_mode=csv -o /home/splunk/splunkresults_bluecoat.csv
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    42    0     0    0    42      0      0 --:--:--  0:03:20 --:--:--     0
[me@myhost00 ~]$ ls
[me@myhost00 ~]$
0 Karma

Builder
  1. Make sure the query generates results by testing it in the UI. To me, it looks like the search is running and finds nothing. I say that because a bad search won't spend time, and it spends time. But it received no bytes.
  2. an FYI: If you run the command where you need the file, you don't need the full path.
###

If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

Yeah the search in the UI returns hundreds of thousands of results.

Yeah I know, I just recalled the previous command so I didnt have to retype it.

0 Karma