topic Re: Export search results to a folder outside splunk in Getting Data In

Export search results to a folder outside splunk

DineshElumalai — Wed, 02 Jul 2025 09:47:54 GMT

Hello Everyone

I need to export the search results to a folder outside the Splunk. To do this job we've exportresults in Splunk which works fine. Basically in my scenario, it is a saved search which runs every week and data has been exported to the folder but it creates a new folder. I need to append the search results to the existing file or else I need to replace the file with the new data.

If I get result for any one of the things mentioned above. I'm good. Thanks.

Re: Export search results to a folder outside splunk

gcusello — Wed, 02 Jul 2025 09:59:05 GMT

Hi @DineshElumalai ,

I suppose that you're speaking of exportcsv, that is usually exported in the $SPLUNK_HOME/var/run/splunk/csv folder (export folder isn't configurable) and than you can use it.

If you export using the same name the file is overwritten, if the file is saved in a different folder maybe there is some customization (e.g. a script that moves the file).

Ciao.

Giuseppe

Re: Export search results to a folder outside splunk

PickleRick — Wed, 02 Jul 2025 10:08:25 GMT

You can use this app - https://splunkbase.splunk.com/app/5738

But it seems to have support for many destinations... except local file. You can get around it by connecting back to the host you're running your Splunk instance on.

Re: Export search results to a folder outside splunk

PrewinThomas — Wed, 02 Jul 2025 10:14:04 GMT

@DineshElumalai
Are you using splunk native csv export? or using any script or rest api to export the results?
If you are using outputcsv i agree with @gcusello export the result to splunk folder and create a script to move to your folder.

Also you can consider using exporting data using rest api with curl.
curl -k -u <username>:<password> https://<splunk-host>:8089/services/search/jobs/export \
-d search="search index=test sourcetype=test earliest=-7d@d latest=now" \
-d output_mode=csv > /external/path/to/destination/results.csv

To append new results to an existing file, use >> instead of >

curl -k -u <username>:<password> https://<splunk-host>:8089/services/search/jobs/export \
-d search="search savedsearch test_weekly_export" \
-d output_mode=csv >> /path/to/your/target/folder/test_report.csv

#https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.3/export-search-results/export-data-using-the-splunk-rest-api

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!