Getting Data In

search/jobs/export does not return results with empty column headers

testingteam
Engager

I using the following command to retrieve a particular macro search result.

curl -k -u admin:admin https://:8089/services/search/jobs/export --data search="search `network_macro(index_name,report_name,server_name,1h)`" -d output_mode=csv

Expected result:
"_time",ServerName,Freq,Bandwidth
"2013-06-03 06:00:00.000 UTC",server1,"74.730000",""
"2013-06-03 07:00:00.000 UTC",server2,"74.730000",""

But the actual result is :
"_time",ServerName,Freq
"2013-06-03 06:00:00.000 UTC",server1,"74.730000"
"2013-06-03 07:00:00.000 UTC",server2,"74.730000"

The column that have empty result has not been returned.

But it is worked well while using
search/jobs/{search_id}
search/jobs/{search_id}/results commands.
I am using Splunk 4.3.1 .

How can we get those empty result columns by using the search/jobs/export url.

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi testingteam

try to use your search with the fillnull command, read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

hope this helps, MuS

testingteam
Engager

Thanks Mus,for your answer.
I have 'n'number of columns.Adding 'fillnull' with all the Columnn names for each query, its hard.

Same macro in 'Search Head' thru Web GUI,the macro result contains all the column names (if data not exist,it displays empty).But in rest api(specifically /jobs/export) why its not returning all the columns.

/jobs/{search_id}/results url gives the expected results then why /jobs/export suppress the columns which not have data.

I expected all the column names(heading) should be returned with the result even it have data or not.

Is there any other way ? Plz help me.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...