I am being forced to output my saved search results in .tsv format, so it appears that the dump command is the way to go.
But how can I identify the full path to the file that I created under var/run/splunk/dispatch so that I can grab the results programmatically before it disappears? I have experimented with the _dstpath variable and only succeeded in burying the file that I want to retrieve deeper under the dispatch/ directory.
Has anyone done this successfully before? I'm sure it's a fairly simple unix solution that I have no experience with ...
Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search
| rest /services/search/jobs | table sid title | search title="yourSavedSearchName" | head 1
The dump command will save the file on disk at
`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/`
directory so your can take the result of above search (sid field) and replace it above
Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search
| rest /services/search/jobs | table sid title | search title="yourSavedSearchName" | head 1
The dump command will save the file on disk at
`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/`
directory so your can take the result of above search (sid field) and replace it above
Have you considered the outputcsv
command?
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/outputcsv
I would love to do that and join everyone in the 21st century, but my client is insisting on a tab-separated values format in the output file.
Once your outputcsv
is done (and we know exactly where it will be), you can just do this to convert CSV to TSV before you ftp it to wherever:
sed "s/,/\t/g" MyOutputFile.csv > MyOutputFilte.tsv