Getting Data In

How to get kvstore data using Splunk's REST API in CSV format?

harshal_chakran
Builder

Hi,
Is there any way I can get the kvstore data in csv format by using the REST API command via curl?

Following is the curl command I am using but the output is coming in json format. I tried output_mode=csv, but it's giving an error.

curl -k -u <uname>:<pwd> https://<hostname>:8089/servicesNS/nobody/<appName>/storage/collections/data/<collectionName>;

Thanks in advance.

1 Solution

jkat54
SplunkTrust
SplunkTrust

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

View solution in original post

0 Karma

harshal_chakran
Builder

Thanks, this helped me to resolve this.
So my final curl command came in as :

curl -k -u <uname>:<pwd>  https://<hotsname>:8089/servicesNS/admin/<appName>/search/jobs/export -d search="|inputlookup <kvstoreName>| table field1, field2, field3" -d output_mode=csv
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!