topic Re: Error in outputcsv command: could not write to file in Reporting

Error in outputcsv command: could not write to file

dbryan — Tue, 09 Apr 2013 01:58:13 GMT

When I run:

search * | head 10 | /home/splunk/test/aaa.csv

I see this error:

Could not write to file '/home/splunk/test/aaa.csv

More info:

Splunk is running as the owner of the directory
the owner has read and write permissions
the directory is on the same filesystem as $SPLUNK_HOME

Anyone have any idea what this could be?

Re: Error in outputcsv command: could not write to file

stephenho — Tue, 09 Apr 2013 03:00:51 GMT

Have you created the csv lookup file under
manager -> lookups -> lookup table files -> new ?

Also, I think your syntax is wrong, and what you actually want to type is

search * |head 10| outputcsv csvfilename.csv

csvfilename.csv being the name of the file you created in the first step.

See if that works for you.

Re: Error in outputcsv command: could not write to file

dbryan — Tue, 09 Apr 2013 06:37:59 GMT

Indeed, I meant to have outputcsv there.

outputcsv doesn't require a lookup table to be created though. I think you're thinking of outputlookup.

It works if I give it a relative path like "filename.csv", but not an absolute path. I'm trying to automate delivery of reports to a shared drive.

Re: Error in outputcsv command: could not write to file

gkanapathy — Tue, 09 Apr 2013 07:17:35 GMT

Outputcsv will only write files to splunk's var/run/splunk directory, for security reasons. It will not write to arbitrary file system locations. You could, I believe, create a symlink (or hard link) to a directory under there and write to that location however.