Reporting

How to automate CSV download of search to windows file explorer

cmintz
New Member

There is an automated report that runs daily in Splunk?
I need it to output the results as a CSV to a directory on my Windows file explorer, so that I can import it into an automated powershell script running as a scheduled task. I already have the powershell script finished, with the assumption that I can import in a CSV from my directory, so all I need at this point is to be able to export the CSV from Splunk automatically to my file explorer when the scheduled report finishes running.

Seems like it should be very easy, but I am unable to find a good answer on how to do so.
Any help would be appreciated, thanks!

0 Karma

493669
Super Champion

although not best way but you can save results using |outputcsv command and create unique csv name using timestamp like | outputcsv [search * | head 1 | eval query="results_".strftime(now(),"%d_%m_%y_%H_%M_%S") | fields query | format "" "" "" "" "" ""
have a look at below links-
https://answers.splunk.com/answers/51140/save-reports-in-shared-folders.html
https://answers.splunk.com/answers/39974/variable-file-name-in-outputcsv.html

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...