Reporting

How to automate CSV download of search to windows file explorer

cmintz
New Member

There is an automated report that runs daily in Splunk?
I need it to output the results as a CSV to a directory on my Windows file explorer, so that I can import it into an automated powershell script running as a scheduled task. I already have the powershell script finished, with the assumption that I can import in a CSV from my directory, so all I need at this point is to be able to export the CSV from Splunk automatically to my file explorer when the scheduled report finishes running.

Seems like it should be very easy, but I am unable to find a good answer on how to do so.
Any help would be appreciated, thanks!

0 Karma

493669
Super Champion

although not best way but you can save results using |outputcsv command and create unique csv name using timestamp like | outputcsv [search * | head 1 | eval query="results_".strftime(now(),"%d_%m_%y_%H_%M_%S") | fields query | format "" "" "" "" "" ""
have a look at below links-
https://answers.splunk.com/answers/51140/save-reports-in-shared-folders.html
https://answers.splunk.com/answers/39974/variable-file-name-in-outputcsv.html

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...