Download raw Splunk logs via api

[vj_hawk21]

Team,

how to remotely execute a search and download the search results and store in a shared drive or a CSV file.

[vj_hawk21]

Hi @rnowitzki 

Thanks for your response.

I have created the search but not able to find its sid/vsid/searc_id.. how to identify the SID?

Thx 

VJ

[rnowitzki]

Hi @vj_hawk21 ,

When you created the Job, the sid was in the response.

 <sid>1258421375.19</sid>

Also, you can get a list of your searches with

curl -u admin:changeme -k https://localhost:8089/services/search/jobs/

BR
Ralph

[rnowitzki]

Hi @vj_hawk21,

Please check the documentation about the REST API:

https://docs.splunk.com/Documentation/Splunk/8.0.6/RESTTUT/RESTsearches

You create a search job, get the sid back and with the sid you can get the results.

To receive the results as csv, you would have to use output_mode=csv  as indicated here. 

BR
Ralph