Getting Data In

Retrieving saved search data using the REST API and showing results in CSV format, is there a way to specify pipe as the delimiter?

sdaruna
Explorer

Hi,

I am trying to receive saved search data using REST API and showing the results in csv format. Is there a way that I can change the delimiter to pipe instead of comma?

The command I used to fetch the data is:

curl -k -u <user>:<pass> -d "search=savedsearch saved_search1" https://<splunk_host>:8089/services/search/jobs/export -d output_mode=csv

I'm getting the data in comma separated format. Now, is there a way that I can specify the delimiter?

Thank You,
Regards,
Srini

0 Karma

jkat54
SplunkTrust
SplunkTrust

To change the default "list separator" used in CSV, you must change your date/time/system settings to use pipes instead of commas. Here's how you do it in windows. You'll need to change this on the server running splunk as far as I know, but you may have to do so on your computer as well.

alt textalt text

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...