Splunk Search

using curl to run REST_API in linux do not return fields

ssaenger
Communicator

Hi All,

i am trying to use Curl to return a search as my result will be >6million to a csv file.
using the command:

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | table subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

this returns the below to filename.csv:

subid,cardid,panelid
,,
,,
,,
,,
,,

If i take the table request out and use the fields:

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | fields subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

This returns the whole log line below to filename.csv:

"2019-02-27 11:49:37.772 GMT","2019/02/27 11:49:37.772 [SenderFile] [c-11]:   INFO:  Report saved to /apps/box_20190227114937772_77777740_5_892222_1223.xml"

In this instance the fields i am trying to put into a table are:

subid 77777740
cardid 892222
panelid 5

When i include table to extract the fields, I don't get anything returned:

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | fields subid cardid panelid |table subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv

any advice would be grateful.
Thanks.

0 Karma

DavidHourani
Super Champion

Hi @ssaenger,

Have you verified that your field extraction is working properly and that their permissions are not set to private ?

Could you please share that config ?

Cheers,
David

0 Karma

ssaenger
Communicator

Hi David,

It was a permissions state.
thank you.

SS

0 Karma

DavidHourani
Super Champion

You're welcome ! Feel free to accept the answer 😄

0 Karma

woodcock
Esteemed Legend

OK, so post the specifics as a new answer and click Accept on that answer to close the question.

0 Karma

woodcock
Esteemed Legend

What happens when you do this?

curl -k -u un:pw https://our_splunk.com:8089/services/search/jobs/export --data-urlencode search='search index=foo sourcetype=bar report | table subid cardid panelid' -d output_mode=csv -d earliest=-6h max_time=0 -o filename.csv
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...