Reporting

How do I export data out of splunk for external reporting

samdeva
Engager

I am looking to extract data out of splunk for historical reporting purpose and to integrate with other large reporting data sources. Can some one tell me how best to export data out of splunk in an automated fashion (APIs, Web Services, etc. so that we can pull at regular frequency). Thanks.

Tags (1)

lassesen
Explorer

Paul, is there any chance of getting an ODBC connector to splunk where you can simply give it the query and it pulls back a dataset?

psanford_splunk
Splunk Employee
Splunk Employee

Hi samdeva - I can help with this request. We are building out a new Python SDK and significant updates to our REST API documentation. Send me an email @: psanford@splunk.com.

Paul

0 Karma

Ayn
Legend

Easiest way would be to use Splunk's CLI search:

$SPLUNK_HOME/bin/splunk search yoursearch -maxout 0

and then grab the output in one way or another. This could be done locally on your Splunk box or remotely from some other box that you want to use for retrieving the events. More information on this is available in the docs, see for instance:

http://www.splunk.com/base/Documentation/4.1.6/Admin/AbouttheCLI

and

http://www.splunk.com/base/Documentation/latest/Developer/UseRemoteCLI

Alternatively, you could retrieve the events through Splunk's REST API. There are SDK's available for a number of languages including Python and Java so you should be able to get it up and running quickly. See http://www.splunk.com/base/Documentation/latest/Developer/RESTIntro

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...