I have a saved search in splunk which has a default start time of 7 days. I have a curl command that works perfectly and exports the last 7 days (default) of data. But is there a way, without changing the default start time in splunk, to export the last 25 hours using curl? My command is... curl -k -u user:password -d "search=savedsearch %22Search%20Name%22" -d "output_mode=csv" -o /home/sample1.csv https://splunk.server:8089/servicesNS/user/search/search/jobs/export The index for this search is index=cep_prd "DEBUG" | table _raw and I have tried this curl command with no luck... curl -k -vvv -u user:password -d "output_mode=csv" -o /home/sample1.csv https://splunk.server:8089/servicesNS/user/search/search/jobs/export --data-urlencode 'search=search index=cep_prd "DEBUG" | table _raw&earliest=-25h@h&latest=now' Can anyone help? ... View more

All URLs and such have been modified for privacy. Can anyone tell me what is happening here? I'm trying to search for "My Search" on a remote splunk server in which it's URL is splunk.website.cc. There is no https:// in front of it. If you try to load https://splunk.website.cc in your normal web browser it will fail. Here is the command I am sending through CLI using Rest API curl -k -3 -vvv -u admin:pass -d "search=savedsearch %22My%20Search%22" -d "output_mode=csv" splunk.website.cc:80/servicesNS/admin/search/search/jobs/export I am using port 80 because that is the port that the server connects to. If I use port 8089, it times out trying to connect to the server. When I run the above command, I get this output in my CLI... * About to connect() to splunk.website.cc port 80 (#0) * Trying 1.1.1.1... connected * Server auth using Basic with user 'admin' > POST /servicesNS/admin/search/search/jobs/export HTTP/1.0 > Authorization: Basic cmFzY2FsOnphY2twYXNzd29yZA== > User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3 > Host: splunk.website.cc > Accept: */* > Content-Length: 51 > Content-Type: application/x-www-form-urlencoded > * upload completely sent off: 51out of 51 bytes < HTTP/1.1 303 See Other < Date: Tue, 23 Oct 2012 18:45:20 GMT < Server: CherryPy/3.1.2 < Content-Length: 194 < Content-Type: text/html;charset=utf-8 < Location: http://splunk.website.cc/en-US/servicesNS/admin/search/search/jobs/export < Set-Cookie: session_id_8000=f2d959814502146df5c678e29f8043ccc4bdf1a4; expires=Wed, 24 Oct 2012 18:45:20 GMT; httponly; Path=/ < Connection: close < * Closing connection #0 Can anyone please explain what this output means and or what I can do to correct it? It's obviously not an output of data from "My Search" Any response would be appreciated! ... View more

When I try to run this command in REST API curl -k -vvv -u user:pass -d "search=savedsearch %22My%20Search%22" https://myserver:80/servicesNS/user/search/search/jobs/export I get this error... * About to connect() to myserver port 80 (#0) * Trying 1.1.1.1... connected * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs * SSLv3, TLS handshake, Client hello (1): * SSLv3, TLS alert, Server hello (2): * error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number * Closing connection #0 curl: (35) error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I edited some fields for my privacy. Does anyone know how to fix this? I'm rather new at Splunk and Rest API ... View more

I'm completely new to splunk and I'm pretty stuck so I'm sorry in advance if any of this is unclear. How would I be able to connect to splunk server on the internet, and retrieve the exported data in a CSV? Where I am at is... splunk -uri https://splunk.website.cc -auth user, pass Any help would be appreciated. ... View more