The easiest way to export is in my opinion to do it via curl . E.g. curl -k -u USERNAME:PASSWORD https://SPLUNK_URL:8089/services/search/jobs/export \ --data-urlencode search='search index="my-index" earliest=0 latest=now | table field1, field2' \ -d output_mode=csv \ -d earliest_time='-y@y' \ -d latest_time='@y' \ -o output-file.csv In this case from the previous year into the file output-file.csv ... View more