https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214130#M42100 <P>I am being forced to output my saved search results in .tsv format, so it appears that the dump command is the way to go.</P> <P>But how can I identify the full path to the file that I created under var/run/splunk/dispatch so that I can grab the results programmatically before it disappears? I have experimented with the _dstpath variable and only succeeded in burying the file that I want to retrieve deeper under the dispatch/ directory.</P> <P>Has anyone done this successfully before? I'm sure it's a fairly simple unix solution that I have no experience with ...</P> Fri, 04 Sep 2015 01:06:11 GMT garywiner 2015-09-04T01:06:11Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214130#M42100 <P>I am being forced to output my saved search results in .tsv format, so it appears that the dump command is the way to go.</P> <P>But how can I identify the full path to the file that I created under var/run/splunk/dispatch so that I can grab the results programmatically before it disappears? I have experimented with the _dstpath variable and only succeeded in burying the file that I want to retrieve deeper under the dispatch/ directory.</P> <P>Has anyone done this successfully before? I'm sure it's a fairly simple unix solution that I have no experience with ...</P> Fri, 04 Sep 2015 01:06:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214130#M42100 garywiner 2015-09-04T01:06:11Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214131#M42101 <P>Have you considered the <CODE>outputcsv</CODE> command?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/outputcsv">http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/outputcsv</A></P> Fri, 04 Sep 2015 20:28:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214131#M42101 woodcock 2015-09-04T20:28:09Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214132#M42102 <P>I would love to do that and join everyone in the 21st century, but my client is insisting on a tab-separated values format in the output file.</P> Fri, 04 Sep 2015 20:37:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214132#M42102 garywiner 2015-09-04T20:37:35Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214133#M42103 <P>Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search </P> <PRE><CODE>| rest /services/search/jobs | table sid title | search title="yourSavedSearchName" | head 1 </CODE></PRE> <P>The dump command will save the file on disk at </P> <PRE><CODE>`$SPLUNK_HOME/var/run/splunk/dispatch/&lt;sid&gt;/dump/` </CODE></PRE> <P>directory so your can take the result of above search (sid field) and replace it above</P> Fri, 04 Sep 2015 21:41:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214133#M42103 somesoni2 2015-09-04T21:41:42Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214134#M42104 <P>Once your <CODE>outputcsv</CODE> is done (and we know <EM>exactly</EM> where it will be), you can just do this to convert CSV to TSV before you ftp it to wherever:</P> <PRE><CODE>sed "s/,/\t/g" MyOutputFile.csv &gt; MyOutputFilte.tsv </CODE></PRE> Fri, 04 Sep 2015 21:48:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identify-the-full-path-to-the-output-file-of-a-dump/m-p/214134#M42104 woodcock 2015-09-04T21:48:25Z