Getting Data In

How can I identify the full path to the output file of a dump command?

garywiner
New Member

I am being forced to output my saved search results in .tsv format, so it appears that the dump command is the way to go.

But how can I identify the full path to the file that I created under var/run/splunk/dispatch so that I can grab the results programmatically before it disappears? I have experimented with the _dstpath variable and only succeeded in burying the file that I want to retrieve deeper under the dispatch/ directory.

Has anyone done this successfully before? I'm sure it's a fairly simple unix solution that I have no experience with ...

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search

| rest /services/search/jobs | table sid title | search title="yourSavedSearchName"  | head 1

The dump command will save the file on disk at

`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/` 

directory so your can take the result of above search (sid field) and replace it above

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search

| rest /services/search/jobs | table sid title | search title="yourSavedSearchName"  | head 1

The dump command will save the file on disk at

`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/` 

directory so your can take the result of above search (sid field) and replace it above

woodcock
Esteemed Legend
0 Karma

garywiner
New Member

I would love to do that and join everyone in the 21st century, but my client is insisting on a tab-separated values format in the output file.

0 Karma

woodcock
Esteemed Legend

Once your outputcsv is done (and we know exactly where it will be), you can just do this to convert CSV to TSV before you ftp it to wherever:

sed "s/,/\t/g" MyOutputFile.csv > MyOutputFilte.tsv
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...