Splunk Search

Why does my search in curl return empty results?

Buscatrufas
Path Finder

Hi guys,

I tried to make a search using curl, but the problem is when the command finalizes, it return empty.

Here is my command:

curl -u user:pass -k https://myURL/services/search/jobs/export --data-urlencode search="search | inputlookup lookup_cve | join CPE_ASSOCIATED [search index=\"analisis_vuln\" sourcetype=\"nmap_csv\" | stats values(ip) by CPE_ASSOCIATED]" -d output_mode=csv -o reporte_`date +%Y-%m-%d`

I don't know where the problem is 😞

Thanks for any help.

Best Regards, Buscatrufas 🙂

0 Karma
1 Solution

Buscatrufas
Path Finder

Can close this guys, thanks anyway. I fixed it by removing search from the string. The final command is the following:

 curl -u user:pass -k https://myURL/services/search/jobs/export --data-urlencode search="| inputlookup lookup_cve | join CPE_ASSOCIATED [search index=\"analisis_vuln\" sourcetype=\"nmap_csv\" | stats values(ip) by CPE_ASSOCIATED]" -d output_mode=csv -o reporte_`date +%Y-%m-%d`

Thanks 🙂

View solution in original post

Buscatrufas
Path Finder

Can close this guys, thanks anyway. I fixed it by removing search from the string. The final command is the following:

 curl -u user:pass -k https://myURL/services/search/jobs/export --data-urlencode search="| inputlookup lookup_cve | join CPE_ASSOCIATED [search index=\"analisis_vuln\" sourcetype=\"nmap_csv\" | stats values(ip) by CPE_ASSOCIATED]" -d output_mode=csv -o reporte_`date +%Y-%m-%d`

Thanks 🙂

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...