That’s definitely not a one liner but more of a loop actually.
Due to my limited time I can only give you parts - Zammad uses ruby on rails so most things actually are very much the same as in every ruby project.
You’re looking for these models:
Ticket and Ticket::Article.
You can construct your query / clause by using Ticket.where(<condition>) and e.g. use .each to loop through that. Without articles you could also use .pluck(:number, created_at) to get the ticket number and ticket creation date in UTC.
Tag usage on CLI is a pain in the butt so sorry, not going to cover it.
Personally I think that you may be much faster with using Zammads API because you don’t require the loop to actually get the articles.
you should be able to construct such an curl command.
Maybe I’m missing something or I’m failing to understand what exactly you’re expecting / missing as information.
If you need to fiddle, tools like Postman might be a much bigger help than initial curl commands. It even allows you to export to e.g. curl commands.