Getting Data In

How to get kvstore data using Splunk's REST API in CSV format?

harshal_chakran
Builder

Hi,
Is there any way I can get the kvstore data in csv format by using the REST API command via curl?

Following is the curl command I am using but the output is coming in json format. I tried output_mode=csv, but it's giving an error.

curl -k -u <uname>:<pwd> https://<hostname>:8089/servicesNS/nobody/<appName>/storage/collections/data/<collectionName>;

Thanks in advance.

1 Solution

jkat54
SplunkTrust
SplunkTrust

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

0 Karma

harshal_chakran
Builder

Thanks, this helped me to resolve this.
So my final curl command came in as :

curl -k -u <uname>:<pwd>  https://<hotsname>:8089/servicesNS/admin/<appName>/search/jobs/export -d search="|inputlookup <kvstoreName>| table field1, field2, field3" -d output_mode=csv
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...