Two updates: 1. This is not caused by the process of upgrading an existing 9.4.3 installation to 10.4.1 as it is also present when installing 10.4.1 (or 10.2.5) from scratch. It is something that has been introduced since 9.4.3 though. 2. It is related to SSL being disabled. In Splunk\etc\system\local\server.conf we have: [sslConfig] enableSplunkdSSL = false If the enableSplunkdSSL line is either removed or changed to true then search exports to CSV are successful. Two related questions: Q1. What has changed since 9.4.3 that stops search CSV exports from working with SSL disabled? Q2. Is there a way to get search CSV exports working in 10.4.1 with SSL disabled? Thanks ... View more

Thanks for the quick response @livehybrid . The URL is: http://127.0.0.1:8000/splunk/en-GB/api/search/jobs/1785230514.1773/event?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=1&filename=splunktest&outputMode=csv ... View more