Splunk Search

Why is my search using curl returning "No results found"?

Navanitha
Path Finder

This is my query and it looks fine to me, but I do not see any output. It just tells me "No results found". Can someone tell me what's wrong with this?

curl -k -u user:pass https://Splunk Server/services/search/jobs/export -d "search= search index=production email1@xyz.com email2@abc.com   "earliest=-12h"  | stats count by Email_ID"  -d "exec_mode=oneshot" -d "output_mode=csv"  \\destinationserver\Reports.csv

Thanks

Tags (3)
0 Karma

tpaulsen
Contributor

Try this:
curl -s -k -u user:pass https:// SPLUNK-SERVER /services/search/jobs -d output_mode=csv --data-urlencode 'search=search index=production email1@xyz.com email2@abc.com "earliest=-12h" | stats count by Email_ID' -d earliest_time=-60m -d latest_time=now -d exec_mode=oneshot

0 Karma

Navanitha
Path Finder

This is not working. It says "Error in 'stats' command: The argument 'earliest_time=-60m' is invalid." I tried putting the latest_time also in the search query but it failed. it again says No Results found.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...