topic Exporting search results automatically in Getting Data In

Exporting search results automatically

logicasrl — Tue, 18 May 2010 20:14:49 GMT

Simple question: how is it possible to export a search result in a CSV file in a scheduled manner (automatically) in Windows? The problem is the "automatically" term: from web interface, interactively, as a matter of fact there is NO problem... Splunk Version is 4.1.2. Thank you very much, Luca

Re: Exporting search results automatically

bwooden — Tue, 18 May 2010 21:52:33 GMT

First, craft the search and make sure it returns the desired results:

sourcetype=syslog

After confirming, pipe that to outputcsv:

sourcetype=syslog | outputcsv results.csv

Finally, drop down the Actions menu and select Save search...
After filling in the desired name, time range, etc. check the Schedule this search checkbox and select a recurrence before saving.

Your file should automatically be generated here at your scheduled interval:

$SPLUNK_HOME/var/run/splunk/results.csv

Re: Exporting search results automatically

logicasrl — Tue, 18 May 2010 22:58:05 GMT

Perfect: it works like a charm 🙂
I've read the documentation, but I was not able to find such an information.
Thank you very much,
Luca

Re: Exporting search results automatically

logicasrl — Wed, 19 May 2010 16:53:59 GMT

Another request about the subject:

which one could be a viable solution if there was the necessity of inserting a "timestamp" into the name of the "result.csv" file above?

Thanks again,

Luca

Re: Exporting search results automatically

Lowell — Fri, 18 Apr 2014 16:15:38 GMT

Here's an question showing a few different ways to add a timestamp to an output file: http://answers.splunk.com/answers/39974/variable-file-name-in-outputcsv