topic Re: How to post "events data file.csv" from Splunk to sharepoint. in Knowledge Management

How to post "events data file.csv" from Splunk to sharepoint.

mohan401 — Tue, 11 Jul 2017 09:09:15 GMT

I am searching events form data summary with meaningful search patterns. Now I need to post my results into share point link with CSV file format. I am using SPLUNK version 6 in Windows platform, How can I post my results into share point? I have to install any plug-in for this?

Re: How to post "events data file.csv" from Splunk to sharepoint.

sbbadri — Tue, 11 Jul 2017 12:23:41 GMT

Have your scheduled search run an "exportcsv"/outputlookup command in the end and the exported csv file will be created in $SPLUNK_HOME/var/run/splunk folder. Later configure an scripted input to either push directly to sharepoint (using some API) or copy it to sharepoint's shared location.

Re: How to post "events data file.csv" from Splunk to sharepoint.

mohan401 — Tue, 11 Jul 2017 13:21:05 GMT

I am connecting SPLUNK through web interface(UI) and I have only User and Dev permissions on my hand. Where I will get $SPLUNK_HOME/var/run/splunk folder.

Re: How to post "events data file.csv" from Splunk to sharepoint.

sbbadri — Tue, 11 Jul 2017 13:47:10 GMT

okay. You can use outputlookup command in your search query and save as report from GUI. so that it will save your report in corresponding apps folder. Then use scripted inputs to post that data in sharepoint.

Below is the link for outputloookup command,

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Outputlookup

Re: How to post "events data file.csv" from Splunk to sharepoint.

mohan401 — Tue, 11 Jul 2017 16:57:22 GMT

I have created csv file using output lookup, then I have installed "splunk app for unix" but I didn't get where to write script. I have searched a lot, we need to change in config file?

Re: How to post "events data file.csv" from Splunk to sharepoint.

sbbadri — Tue, 29 Sep 2020 14:50:10 GMT

click on settings->Data Inputs->Scripts.

Scripth Path-> $SPLUNK_HOME$/etc/apps/splunk_app_for_unix/bin
Command -> your command or steps
Interval Inputs -> seconds
Interval ->
Source name override : optional

Re: How to post "events data file.csv" from Splunk to sharepoint.

mohan401 — Tue, 29 Sep 2020 14:53:40 GMT

Thank you sbbadri, In Command block we can only select the script which one we have to run but I want to know how to copy my script into $SPLUNK_HOME$/etc/apps/splunk_app_for_unix/bin path

Re: How to post "events data file.csv" from Splunk to sharepoint.

mohan401 — Wed, 12 Jul 2017 05:43:46 GMT

And one more thing actually I don't have Data Inputs option in settings. How to enable it?

Re: How to post "events data file.csv" from Splunk to sharepoint.

sbbadri — Tue, 29 Sep 2020 14:50:46 GMT

Then you don't have enough permission. So need to ask the right person to copy the scripts to $SPLUNK_HOME/etc/apps/splunk_app_for_unix through ssh to that server.

Re: How to post "events data file.csv" from Splunk to sharepoint.

sbbadri — Wed, 12 Jul 2017 13:37:35 GMT

For Data Inputs option you need to modify your role i.e., need to add right capabilities.

Below is the link,
https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Authorizeconf

Re: How to post "events data file.csv" from Splunk to sharepoint.

mohan401 — Mon, 17 Jul 2017 09:43:50 GMT

Can you know where Dashboards will save and how to copy to SharePoint link

Re: How to post "events data file.csv" from Splunk to sharepoint.

deepika — Wed, 14 Sep 2022 10:13:42 GMT

@mohan401 I have similar use case. I am very new to written scripts. Could you please share the scripts that you have written.