Reporting

export search results using curl

jonathanfalconi
Explorer

Hi,
I was advised that curl was a workaround used for exporting search results to csv.
Problem is I do not know how to export specific jobs in the jobs manager and I need assistance with the correct syntax:

curl -k -u admin:password! -o 120979_curl.csv --data-urlencode search="search source=log.tar.*" -d "output_mode=csv" exampleurl:8089/servicesNS/admin/search/search/jobs/export

I suspect it is not working because of the search= source=log.tar.* being incorrect... What should I be adding in this field so I download the correct job?

The search I ran was the following
search * | regex _raw=".*/[a-f0-9]{32}/[a-z]{1,15}-[a-z]{1,15}.php" and this is how it appears in teh job manager.

Lastly if I wanted to view the search jobs results on the cli - where would I find the results and couldn't I just scp this file off instead of using curl?

Tags (2)
0 Karma

Lucas_K
Motivator

Saw this in another post that shows the correct format of the dataurl encode ( http://answers.splunk.com/answers/64345/how-to-export-the-last-25-hours-of-data-using-curl )

So the command should be something like :

curl -k -u admin:password -d "output_mode=csv" -o /home/sample1.csv
https://splunk.server:8089/servicesNS/admin/search/search/jobs/export
--data-urlencode 'search=search earliest=-1d@d latest=@d index=blah
source=log.tar.*'

0 Karma

benjaminw
New Member

I ran a search using this syntax, and received the error "curl: option --data-urlencode: is unknown"

Any ideas?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...