Scheduled shell-script to copy data like csv-files with splunk

[gerdhuber]

Hallo,

i want to execute daily a shell-script, that copys data to the csv-dir from Splunk.

Is it a good way to do this with splunk, or should i use therefore linux-cron.

please send me the necessary file to do this, thank you

Regards Gerd

[aakwah · Accepted solution]

Hello,

If the trigger of the execution of the script is based on search results, then you can use Splunk alerts to achieve this.

After you search is completed, click on Save As -> Alert -> Add Actions -> Run a script -> type script name.

Location of script:
$SPLUNK_HOME/bin/scripts

Regards

[woodcock]

There is no native way to do this in Splunk but there might be an app on splunkbase to do this. We always setup a cron job to copy anything with a particular prefix to the transfer directory (stripping the prefix from the filename), just like you are suggesting.

[gcusello]

Hi gerdhuber,
sorry but I don't understand your question:

• do you want to extract data from Splunk and copy it into a csv file,
• or you want to copy a csv file from a folder in another one?

To do the first choice, you don't need cron, you can schedule a search (e.g. using an alert) that export the results of a Splunk search in a csv file.
To export the result of a Splunk search in a csv file you can add at the end of your search the outputcsv command (see http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Outputcsv).
Remember that the folder where you can find csv files is fixed: $SPLUNK_HOME/var/run/splunk/csv

If instead you want to copy a csv file from a folder into another one you have to use cron.

Bye.
Giuseppe