Include CSV Report in Splunk Search Job API Results for Ticketing Integration

[cipher]

Hi,

I’ve set up an alert in Splunk that triggers whenever there are log gaps (missing logs) from hosts, based on the RecordNumber Windows events within a defined time window. I also have a Python script that creates tickets in our custom ticketing tool by fetching data from Splunk using the /search/jobs/{sid}/results API. The payload currently includes the list of affected hosts and the count of hosts.

| eval status="There were gaps in Splunk logs from the above hosts in last 1h"
| stats
dc(host) AS affected_hosts
values(host) AS hosts
values(status) AS status

Now, I’d like to enhance the ticket by attaching a CSV report of the gaps. Specifically, I want the API response to include a CSV file in the payload whenever I pull the data, so that the ticket contains both the summary and the detailed report.


Is there a way to achieve this?

[livehybrid · Accepted solution]

Hi @cipher 

If you add output_mode=csv to your existing /search/jobs/{sid}/results you will get your results as a CSV format.

For more info see https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.2/export-search-results/export-d...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing