topic Re: How do I output to text (csv or json) per-minute that aggregates continuously in real time? in Getting Data In

How do I output to text (csv or json) per-minute that aggregates continuously in real time?

gerberm — Mon, 03 Jun 2019 14:26:07 GMT

How do I output to text (csv or json) per-minute aggregates continuously in real time? The resulting file will be scraped continuously by another tool.

Re: How do I output to text (csv or json) per-minute that aggregates continuously in real time?

martynoconnor — Mon, 03 Jun 2019 17:03:20 GMT

In Splunk, write your search which generates the data you need, and then presents it in a tabular format that you'd like the CSV to be in. Then, at the end of your search, use |outputcsv append=true - which will place the csv file on the filesystem in /opt/splunk/var/run

The documentation is here - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputcsv

The major important difference between using outputlookup and outputcsv is that as the csv grows in size, had you used outputlookup you will be potentially replicating that large file between clustered search heads. If you just want an external tool to monitor it, use outputcsv instead.

Regards,

Martyn

Re: How do I output to text (csv or json) per-minute that aggregates continuously in real time?

gerberm — Tue, 04 Jun 2019 07:54:07 GMT

Thanks but that answer doesn't adress the continuous aspect.
I have "...| bin _time span=1m | table _time, A, B | outputcsv append-true myfile" and that works when I run it as a search directly in the UI. Saving it as a report with a cron schedule of "* * * * *" doesn't appear to do anything. No csv is generated. The outputcsv part appears to get stripped off.