Splunk Enterprise

Download raw Splunk logs via api

vj_hawk21
Explorer

Team,

how to remotely execute a search and download the search results and store in a shared drive or a CSV file.

Labels (2)
0 Karma

vj_hawk21
Explorer

Hi @rnowitzki 

Thanks for your response.

I have created the search but not able to find its sid/vsid/searc_id.. how to identify the SID?

Thx 

VJ

0 Karma

rnowitzki
Builder

Hi @vj_hawk21 ,

When you created the Job, the sid was in the response.

 <sid>1258421375.19</sid>


Also, you can get a list of your searches with

curl -u admin:changeme -k https://localhost:8089/services/search/jobs/

 

BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

rnowitzki
Builder

Hi @vj_hawk21,

Please check the documentation about the REST API:

https://docs.splunk.com/Documentation/Splunk/8.0.6/RESTTUT/RESTsearches

You create a search job, get the sid back and with the sid you can get the results.

To receive the results as csv, you would have to use output_mode=csv  as indicated here

BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...