topic Re: After using outputcsv in a Splunk search, where is this CSV file located? in Getting Data In

After using outputcsv in a Splunk search, where is this CSV file located?

asarran — Tue, 02 Aug 2016 16:12:09 GMT

Hey Splunkers

I'm new to Splunk and I'm having issues attempting to export a search results to a CSV file.

<MY SEARCH> | outputcsv  mycsvfilename

The trouble I'm having is the ability to locate the CSV file on my desktop. I can't find the file. The assumption is that the file is being sent somewhere else? I'm curious if anyone has ever encountered a problem similar to this before.

Thank You,

Re: After using outputcsv in a Splunk search, where is this CSV file located?

Raghav2384 — Tue, 29 Sep 2020 10:27:31 GMT

Hello @asarran,

Please take a look : https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Outputcsv

If you have Splunk Enterprise, this command saves search results to the specified CSV file on the local search-head in the $SPLUNK_HOME/var/run/splunk/csv directory. Updates to $SPLUNK_HOME/var/run/*.csv using the outputcsv command are not replicated across the cluster.

You can then add that csv back as a lookup or monitoring that directory for *.csv if outputcsv is something you use very often. Hope this helps

Hope this Helps!

Thanks,
Raghav

Re: After using outputcsv in a Splunk search, where is this CSV file located?

asarran — Tue, 02 Aug 2016 18:44:41 GMT

interesting, unfortunately I currently don't have access to the command interface of the header. I'm wandering would there be any other means I can export this query to a csv file on my desktop. I believe one option would be to schedule a report and have the report be emailed. I'm curious is there another method that is available?

Thanks, Raghav

Re: After using outputcsv in a Splunk search, where is this CSV file located?

somesoni2 — Tue, 02 Aug 2016 20:41:14 GMT

You should be able to export the search result manually (if running the search on ad-hoc basis). See this

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Exportsearchresults#Export_data_using_Splunk_Web

Re: After using outputcsv in a Splunk search, where is this CSV file located?

asarran — Tue, 02 Aug 2016 20:43:25 GMT

Thank You.