Extract data via rest api

[preben12]

I have some sample data generated from
curl -k -u admin:password https://localhost:8089/services/search/jobs/export -d search="search index=tweets | multikv from_user start_time" -d earliest_time="-4h" -d latest_time="now" -d output_mode="xml"

How can i extract eg. the from_user and start_time from the _raw field so it gets a ordinary search result field in the search result ?

->

<result offset='1487'>
        <field k='_bkt'>
            <value><text>tweets~39~6909193E-A0BE-4EC0-8F2F-9E47CAE7DEF2</text></value>
        </field>
        <field k='_cd'>
            <value><text>39:278787</text></value>
        </field>
        <field k='_indextime'>
            <value><text>1383149603</text></value>
        </field>
        <field k='_raw'><v xml:space='preserve' trunc='0'>2013-10-30    17:13:23:443+0100 name=&quot;twitter-message&quot; from_user=&quot;someuser&quot; in_reply_to=&quot;null&quot; start_time=&quot;Wed Oct 30 17:13:09 CET 2013&quot; event_id=&quot;395584165271203840&quot; text=&quot;I voted for Girls&apos; Generation&apos;s &quot;I Got a Boy&quot; to win Video of the Year at the YouTube Music Awards. http://t.co/igD2gPOrYI #YTMAhgh&quot; retweet_count=&quot;0&quot;</v></field>
        <field k='_serial'>
            <value><text>1980</text></value>
        </field>
        <field k='_si'>
            <value><text>mac.local</text></value>
            <value><text>tweets</text></value>
        </field>
        <field k='_sourcetype'>
            <value><text>twitter-feed</text></value>
        </field>
        <field k='_subsecond'>
            <value><text>.443</text></value>
        </field>
        <field k='_time'>
            <value><text>2013-10-30 17:13:23.443 CET</text></value>
        </field>
        <field k='host'>
            <value><text>127.0.0.1</text></value>
        </field>
        <field k='index'>
            <value h='1'><text>tweets</text></value>
        </field>
        <field k='linecount'>
            <value><text>1</text></value>
        </field>
        <field k='source'>
            <value><text>mysource</text></value>
        </field>
        <field k='sourcetype'>
            <value><text>twitter-feed</text></value>
        </field>
        <field k='splunk_server'>
            <value><text>mac.local</text></value>
        </field>
    </result>

[preben12 · Accepted solution]

doh - I'll answer this my self. Quite simple just do:

curl -k -u admin:password https://localhost:8089/services/search/jobs/export -d search="search index=tweets | fields *" -d earliest_time="-4h" -d latest_time="now" -d output_mode="xml"

or a list of fields if you wanna have specific fields kvp's