topic Re: Retrieve output data from Splunk in Getting Data In

Retrieve output data from Splunk

JosIJntema — Wed, 17 May 2017 12:33:19 GMT

Hi there,

We want to get data from Splunk after a Splunk search has outputted the data in a file.

Case
In Splunk we have events for each user. With these events we can categorise users in target groups. What we can do is make an output everyday where the users are updated and for each user id the target group is saved.

How could I then query this information from for example a website?

Is this a good use of Splunk? Is there another solution that better solves what I want to achieve?

Thanks!

Re: Retrieve output data from Splunk

gcusello — Wed, 17 May 2017 12:43:33 GMT

Hi JosIJntema,
Yes, you can extract the number of events for each user, export results in a file and then categorize results in Excel.
to write the result of a Splunk search you can add at the end of your search the outputcsv command (see http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Outputcsv).
Remember that the folder where you can find csv files is fixed: $SPLUNK_HOME/var/run/splunk/csv

But I'd prefer to do the same categorization adding to your app a lookup containing users and categories, in this way you can create a report with categories, users and the number of events for each user.
You have many advantages of this methis:

you'll use only one tool to create your report;
you don't need to do manual operations on results;
in addition, you can also verify if someone of your users hasn't events.

Bye.
Giuseppe

Re: Retrieve output data from Splunk

woodcock — Wed, 17 May 2017 12:50:50 GMT

You are describing Summary Indexing; read all about it here:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing