topic Re: Finding reports via the cli in Splunk Enterprise

Finding reports via the cli

David_M — Tue, 22 Apr 2025 12:19:45 GMT

Hello,

I setup 2 reports to run early this AM. Looks like both reports ran according to splunk. The problem I have now is finding the actual .csv files on the splunk server so I can scp them.

Thank...

Re: Finding reports via the cli

kiran_panchavat — Tue, 22 Apr 2025 12:27:27 GMT

@David_M

By default, when a Splunk report generates a CSV file (e.g., using the outputcsv command or scheduled report export), the files are saved in the $SPLUNK_HOME/var/run/splunk/csv directory on the search head where the report was executed.

$SPLUNK_HOME is typically /opt/splunk on Linux systems, so the full path would be /opt/splunk/var/run/splunk/csv/.

Navigate to this directory using a terminal:

cd /opt/splunk/var/run/splunk/csv
ls -l

Look for files with a .csv extension. The file names might correspond to the report name, search job ID, or a custom name specified in the report configuration

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Outputcsv

Please refer to this for more details, as highlighted by @gcusello :

https://community.splunk.com/t5/Getting-Data-In/Is-there-anyway-to-generate-and-store-CSV-files-in-a-specific/td-p/465996

Re: Finding reports via the cli

David_M — Tue, 22 Apr 2025 12:31:58 GMT

Hi Kiran,

Well I checked the directory mentioned in the posts and the files aren't there for some reason.

David

Re: Finding reports via the cli

kiran_panchavat — Tue, 22 Apr 2025 12:56:17 GMT

@David_M

Verify that the reports are configured to generate CSV files. In Splunk Web, go to Settings > Searches, Reports, and Alerts, find your reports, and check their settings.

you have two choices:

1) schedule an alert adding csv as attachment, to receive the csv via email.

2) you could schedule a report adding the outputcsv command at the end.

In this way, you save your report as csv in a pre-defined folder (not changeable!).

Re: Finding reports via the cli

livehybrid — Tue, 22 Apr 2025 13:23:18 GMT

Hi @David_M

Did you use outputcsv, or some other method for exporting the csv such as using the "Output results to lookup" alert action?

As previously mentioned - the output path for outputcsv is $SPLUNK_HOME/var/run/splunk/csv - however these files are not replicated across the cluster if you are running a SHC.

If you're using the outputcsv, can you confirm you arent using dispatch=true ? If you are you then your job will be in $SPLUNK_HOME/var/run/splunk/dispatch/<job id>/csv

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Finding reports via the cli

David_M — Tue, 22 Apr 2025 13:50:26 GMT

Hi Kiran,

Yea adding the outputcsv command fixed the issue.

Thanks!

David

Re: Finding reports via the cli

kiran_panchavat — Tue, 22 Apr 2025 16:40:55 GMT

@David_M Good to know that adding the outputcsv command resolved the issue.