topic Re: Export Splunk results to an XML output? in Dashboards & Visualizations

Export Splunk results to an XML output?

Dark_Ichigo — Wed, 02 Nov 2011 04:57:27 GMT

Is there a way to export Splunk results from a Report, chart...etc to an XML based output?

I noticed that someone was trying to accomplish this but there wasn't enough information on the approach of how he was achieving this: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command

Re: Export Splunk results to an XML output?

Damien_Dallimor — Wed, 02 Nov 2011 05:41:02 GMT

Not an export as such, but you could invoke the search using the REST api.

Re: Export Splunk results to an XML output?

Dark_Ichigo — Wed, 02 Nov 2011 05:50:48 GMT

So I can extract the events and arrange them by there field names using a python script to do so?

Re: Export Splunk results to an XML output?

Dark_Ichigo — Wed, 02 Nov 2011 06:48:39 GMT

Ok, I have found out that there is an automated feature in splunk that allows you to export your results at a Click of a Button ( Basically the Action Menu 😛 ).

I also discovered with Damien's help that I can play around with it using the REST API, via a Python Script so that I may Modify the XML to the way I want it to look.

But Im not exactly %100 sure that if you can Modify the OutPut XML to your requirements?, can this be done?, has anyone ever tried this?, again the only person I found that actually engaged in performing this the way I want to is MW with his question: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command

Re: Export Splunk results to an XML output?

Damien_Dallimor — Wed, 02 Nov 2011 23:56:42 GMT

I'm not sure about the feasibility of modifying the schema of the response XML.
But as you mention, from your python script, you could use the Splunk Python SDK and then transform the original result XML from the REST call into an XML format to suit your specific requirements.

Re: Export Splunk results to an XML output?

bharathkumarnec — Thu, 18 May 2017 04:51:59 GMT

Hi All,

Looks like this can be done via splunkweb,CLI,REST API,SDK's & Dump commands. PFB link for more information:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Search/Exportsearchresults