There is an automated report that runs daily in Splunk?
I need it to output the results as a CSV to a directory on my Windows file explorer, so that I can import it into an automated powershell script running as a scheduled task. I already have the powershell script finished, with the assumption that I can import in a CSV from my directory, so all I need at this point is to be able to export the CSV from Splunk automatically to my file explorer when the scheduled report finishes running.
Seems like it should be very easy, but I am unable to find a good answer on how to do so.
Any help would be appreciated, thanks!
although not best way but you can save results using |outputcsv
command and create unique csv name using timestamp like | outputcsv [search * | head 1 | eval query="results_".strftime(now(),"%d_%m_%y_%H_%M_%S") | fields query | format "" "" "" "" "" ""
have a look at below links-
https://answers.splunk.com/answers/51140/save-reports-in-shared-folders.html
https://answers.splunk.com/answers/39974/variable-file-name-in-outputcsv.html