Splunk Search

Why is my search using curl returning "No results found"?

Navanitha
Path Finder

This is my query and it looks fine to me, but I do not see any output. It just tells me "No results found". Can someone tell me what's wrong with this?

curl -k -u user:pass https://Splunk Server/services/search/jobs/export -d "search= search index=production email1@xyz.com email2@abc.com   "earliest=-12h"  | stats count by Email_ID"  -d "exec_mode=oneshot" -d "output_mode=csv"  \\destinationserver\Reports.csv

Thanks

Tags (3)
0 Karma

tpaulsen
Contributor

Try this:
curl -s -k -u user:pass https:// SPLUNK-SERVER /services/search/jobs -d output_mode=csv --data-urlencode 'search=search index=production email1@xyz.com email2@abc.com "earliest=-12h" | stats count by Email_ID' -d earliest_time=-60m -d latest_time=now -d exec_mode=oneshot

0 Karma

Navanitha
Path Finder

This is not working. It says "Error in 'stats' command: The argument 'earliest_time=-60m' is invalid." I tried putting the latest_time also in the search query but it failed. it again says No Results found.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...