Splunk Search

Extract data via rest api

preben12
Communicator

I have some sample data generated from
curl -k -u admin:password https://localhost:8089/services/search/jobs/export -d search="search index=tweets | multikv from_user start_time" -d earliest_time="-4h" -d latest_time="now" -d output_mode="xml"

How can i extract eg. the from_user and start_time from the _raw field so it gets a ordinary search result field in the search result ?

->

<result offset='1487'>
        <field k='_bkt'>
            <value><text>tweets~39~6909193E-A0BE-4EC0-8F2F-9E47CAE7DEF2</text></value>
        </field>
        <field k='_cd'>
            <value><text>39:278787</text></value>
        </field>
        <field k='_indextime'>
            <value><text>1383149603</text></value>
        </field>
        <field k='_raw'><v xml:space='preserve' trunc='0'>2013-10-30    17:13:23:443+0100 name=&quot;twitter-message&quot; from_user=&quot;someuser&quot; in_reply_to=&quot;null&quot; start_time=&quot;Wed Oct 30 17:13:09 CET 2013&quot; event_id=&quot;395584165271203840&quot; text=&quot;I voted for Girls&apos; Generation&apos;s &quot;I Got a Boy&quot; to win Video of the Year at the YouTube Music Awards. http://t.co/igD2gPOrYI #YTMAhgh&quot; retweet_count=&quot;0&quot;</v></field>
        <field k='_serial'>
            <value><text>1980</text></value>
        </field>
        <field k='_si'>
            <value><text>mac.local</text></value>
            <value><text>tweets</text></value>
        </field>
        <field k='_sourcetype'>
            <value><text>twitter-feed</text></value>
        </field>
        <field k='_subsecond'>
            <value><text>.443</text></value>
        </field>
        <field k='_time'>
            <value><text>2013-10-30 17:13:23.443 CET</text></value>
        </field>
        <field k='host'>
            <value><text>127.0.0.1</text></value>
        </field>
        <field k='index'>
            <value h='1'><text>tweets</text></value>
        </field>
        <field k='linecount'>
            <value><text>1</text></value>
        </field>
        <field k='source'>
            <value><text>mysource</text></value>
        </field>
        <field k='sourcetype'>
            <value><text>twitter-feed</text></value>
        </field>
        <field k='splunk_server'>
            <value><text>mac.local</text></value>
        </field>
    </result>
Tags (3)
0 Karma
1 Solution

preben12
Communicator

doh - I'll answer this my self. Quite simple just do:

curl -k -u admin:password https://localhost:8089/services/search/jobs/export -d search="search index=tweets | fields *" -d earliest_time="-4h" -d latest_time="now" -d output_mode="xml"

or a list of fields if you wanna have specific fields kvp's

View solution in original post

0 Karma

preben12
Communicator

doh - I'll answer this my self. Quite simple just do:

curl -k -u admin:password https://localhost:8089/services/search/jobs/export -d search="search index=tweets | fields *" -d earliest_time="-4h" -d latest_time="now" -d output_mode="xml"

or a list of fields if you wanna have specific fields kvp's

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...