topic Splunk search result to csv format in Getting Data In

Splunk search result to csv format

hemendralodhi — Thu, 12 Oct 2017 01:13:09 GMT

Hello,

We have requirement to have Splunk search/dashboard result data in csv format to be fed into another tool. There should not be any manual process- search should run at scheduled time provide result to be picked by another tool.

Options:

1) The tool can pick the csv file generated from search using outputcsv command but in doc it was written that it is not supported in distributed env. So if any other node run the search it will written local to that search node. Tool need to check all the nodes for the file. This can be done based on script checking the timestamp of the file generated and pulling it.

2) Can query write the data into separate index in csv format and tool can use Splunk API details to pull up the data?

Are there any other ways to implement this and which might be the best option?

Thanks
Hemendra

Re: Splunk search result to csv format

pradeepkumarg — Thu, 12 Oct 2017 02:42:21 GMT

You can use outputlookup instead of outputcsv. The file should then replicate all to all the nodes provided you are running search head cluster

The best way is to run the search via Splunk Rest API and get the results

Re: Splunk search result to csv format

493669 — Thu, 12 Oct 2017 03:01:42 GMT

You can try:

<some serch query>....|outputlookup test.csv

It will save your search query results into test.csv file and it will get replicated to all search heads (supported in distributed environment).
Then when you want use that csv file to pick up by another tool then you can try below query:

|inputlookup test.csv|table... <some search query>