# Export saved search data to csv from command line

**URL:** <https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418>\
**Category:** Graylog Central (peer support)\
**Created:** [January 17, 2019, 3:39pm UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418 "2019-01-17T15:39:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![martinwoodger](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@martinwoodger](https://community.graylog.org/u/martinwoodger)\
**Post date:** [January 17, 2019, 3:39pm UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/1 "2019-01-17T15:39:49Z")

</div>

Hi,  
I saw this topic entry: [Graylog 2.3.1 - Export to CSV via API Call](https://community.graylog.org/t/graylog-2-3-1-export-to-csv-via-api-call/4102) now closed and wondered if there is now a solution for it as I have the same requirement.

I am using this command:

curl -u user:pwd -H ‘Accept: text/csv’ -X GET ‘http://:9000/search?saved=5c3c8b7986fc7c3f9fb675a4&width=1903&rangetype=relative&fields=%2Cfw\_action%2Cfw\_categoryname%2Cfw\_url%2Cfw\_user&relative=604800&q=fw\_action%20%3D%20block%20%26%26%20\_exists\_%3Afw\_user’

but so far I only seem to get a page 404 error so making less progress than my predecessor. Also more a problem for once it is working, but I also don’t seem able to give roles or users access to the search menu option or to saved searches and so presume from this that the credentials would need to be those of our admin account.

Any help in getting this to work or alternative solutions for automating export of CSV data would be much appreciated.

Thanks,  
Martin

---

<div class="post-metadata">

**Author:** ![texas-bronius](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/texas-bronius/32/1051_2.png) [@texas-bronius](https://community.graylog.org/u/texas-bronius)\
**Post date:** [January 17, 2019, 7:31pm UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/2 "2019-01-17T19:31:35Z")

</div>

Is it a typo or otherwise intentionally omitted that you don’t have a hostname (maybe `localhost` or `127.0.0.1`) in your copy/pasted command?

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [January 17, 2019, 10:56pm UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/3 "2019-01-17T22:56:56Z")

</div>

or just hide his/her IP…

@martinwoodger  
only admins have acces to search menu. You can give rights on streams, eg. all messages.

Do you really want to use saved search? You can use the keywords in the CLI export also. OK, it is a workaround, but maybe could work.

---

<div class="post-metadata">

**Author:** ![martinwoodger](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@martinwoodger](https://community.graylog.org/u/martinwoodger)\
**Post date:** [January 18, 2019, 9:11am UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/4 "2019-01-18T09:11:45Z")

</div>

Hi sorry I meant to put in a generic “servername” so removed it but then forgot. i am using IP address when I run the command.

---

<div class="post-metadata">

**Author:** ![martinwoodger](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@martinwoodger](https://community.graylog.org/u/martinwoodger)\
**Post date:** [January 18, 2019, 9:19am UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/5 "2019-01-18T09:19:58Z")

</div>

I’m quite new to graylog, but with saved search I found it was easier to produce the output I needed. I will take another look at streams on your advice, thanks.

---

<div class="post-metadata">

**Author:** ![martinwoodger](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@martinwoodger](https://community.graylog.org/u/martinwoodger)\
**Post date:** [January 21, 2019, 9:43am UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/6 "2019-01-21T09:43:59Z")

</div>

I now have my blocked web request data streaming to a csv output using a csv export plugin on github. So thanks for the direction and thanks to R Westmoreland for this plugin: [https://github.com/rswestmoreland/graylog-delimited-file-output-plugin](https://github.com/rswestmoreland/graylog-delimited-file-output-plugin)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 4, 2019, 9:44am UTC](https://community.graylog.org/t/export-saved-search-data-to-csv-from-command-line/8418/7 "2019-02-04T09:44:07Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
