Getting Data In

How to get kvstore data using Splunk's REST API in CSV format?

Hi,
Is there any way I can get the kvstore data in csv format by using the REST API command via curl?

Following is the curl command I am using but the output is coming in json format. I tried output_mode=csv, but it's giving an error.

curl -k -u <uname>:<pwd> https://<hostname>:8089/servicesNS/nobody/<appName>/storage/collections/data/<collectionName>;

Thanks in advance.

1 Solution

SplunkTrust
SplunkTrust

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Use the search endpoints and inputlookup instead:

https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTsearch

The search job endpoint allows you to pull the data in csv format and the inputlookup search command allows you to pull the kvstore data.

View solution in original post

0 Karma

Thanks, this helped me to resolve this.
So my final curl command came in as :

curl -k -u <uname>:<pwd>  https://<hotsname>:8089/servicesNS/admin/<appName>/search/jobs/export -d search="|inputlookup <kvstoreName>| table field1, field2, field3" -d output_mode=csv