Splunk Search

Clarification on using dump command

Jananee_iNautix
Path Finder

There's a requirement to export the search results from Splunk to a custom location in Unix server. The search has to be run periodically and the results should be exported to the custom location.

Could you please confirm if dump command is the one to be used. If so, can we override to a custom location (or) would it go within the following folder by defualt ($SPLUNK_HOME/var/run/splunk/dispatch//dump) with the custom location appended to it by the use of _dstpath=strftime(_time, "%Y%m%d/%H") + "/" + host

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

There are many options to export the search result to a file.

Using Search:

You can add search commands like "outputcsv" OR "outputtext" [output to $SPLUNK_HOME/var/run/splunk], OR "dump" ($SPLUNK_HOME/var/run/splunk/dispatch//dump). These location can't be changed.
To run this periodically just create a saved search.

Using Splunk CLI:

Your can export search result to a file using following command.

splunk search "|savedsearch YourSavedSearchName" -auth username:password -output csv > /your/custom/location/yourfilename.csv

OR

splunk search "index=blah .....your search "  -earliest_time -1h@h -latest_time @h -maxout 0  -auth username:password -output csv > /your/custom/location/yourfilename.csv

You can write a shell script with these command and set the shell script as action of a schedule search.

Jananee_iNautix
Path Finder

The field "tmp_dir" is not mentioned in the splunk documentation for dump command.Still when I used it along with the dump command for exporting the search results to a temporary location ,it works.Can you tell whether it is advisable to use it and the reason for its working.

hexx
Splunk Employee
Splunk Employee

While functional, the "tmp_dir" argument of the "dump" search operator has been deemed unsafe and therefore has been removed in Splunk Enterprise 6.1 and beyond. This also explains why you can't find it as a documented argument.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...