How can I identify the full path to the output file of a dump command?

[garywiner]

I am being forced to output my saved search results in .tsv format, so it appears that the dump command is the way to go.

But how can I identify the full path to the file that I created under var/run/splunk/dispatch so that I can grab the results programmatically before it disappears? I have experimented with the _dstpath variable and only succeeded in burying the file that I want to retrieve deeper under the dispatch/ directory.

Has anyone done this successfully before? I'm sure it's a fairly simple unix solution that I have no experience with ...

[somesoni2 · Accepted solution]

Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search

| rest /services/search/jobs | table sid title | search title="yourSavedSearchName"  | head 1

The dump command will save the file on disk at

`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/` 

directory so your can take the result of above search (sid field) and replace it above

[woodcock]

Have you considered the outputcsv command?

http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/outputcsv

[garywiner]

I would love to do that and join everyone in the 21st century, but my client is insisting on a tab-separated values format in the output file.

[woodcock]

Once your outputcsv is done (and we know exactly where it will be), you can just do this to convert CSV to TSV before you ftp it to wherever:

sed "s/,/\t/g" MyOutputFile.csv > MyOutputFilte.tsv