Splunk Search

Exporting search results to a specified path

bleung93
Path Finder

I have looked at commands "outputlookup" and "outputcsv". Is there a way to export your search results to a specified path outside of $SPLUNK_HOME?

Another situation, doing the same thing as above but while ssh to a spunk instance and executing the command via CLI.

Being able to do this would be more efficient than in the UI and getting your csv in Downloads folder.

0 Karma

woodcock
Esteemed Legend

There is no way to do this directly but what We did was create a cron job that continuously watched the dispatch directory and whenever it found an outputcsv file with a proprietarily-encoded username/email, it would transport the file appropriately. This can be very important because it is VERY VERY easy to accidentally fill up the dispatch directory such that no searches will run or complete until the huge outputcsv file is removed.

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...