Why is my Splunk events search not working with curl?

[mukesh2019]

Hi Everybody,

I was trying to run the below search events commands with Splunk but I'm getting incorrect data.The count should have been 747, but its 0. Please suggest.

curl -k -u user:pass https://host.domain.com:8089/services/search/jobs --get -d search="index=1234_nontricare  source=/abc/logs/cpp*atch/aep/bw-monitoring-gsspcc.log| stats count as Total" -d output_mode=json

<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
     . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
      . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
   . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
 <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" 
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>jobs</title>
<id>https://host.domain.com:8089/services/search/jobs</id>
<updated>2018-12-19T09:56:22-05:00</updated>
<generator build="59c8927def0f" version="6.5.0"/>
<author>
<name>Splunk</name>
</author>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>0</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
</feed>

Thanks in Advance .Apologies for not editing properly.

[whrg · Accepted solution]

Hello @mukesh2019,

The services/search/jobs endpoint, which you are using, is for 1) getting details of all current searches (GET) or 2) starting a new search and return the search ID (POST).

It looks like you want to run a oneshot search. I think you are better off here with the services/search/jobs/export endpoint.

Here is an example:

curl -k -u user:password https://yoursplunkserver:8089/services/search/jobs/export -d search="search index%3D_internal | head 5" -d output_mode=csv