topic Re: Export from counttable broken in Reporting

Export from counttable broken

timbCFCA — Thu, 09 Aug 2012 19:19:14 GMT

I have a pretty basic query which generates a large (several hundred by several hundred) table.

 host=XX OR host=YY print evtid="10" splunk_server="ami" | counttable evtuser, Printer_Name

I need to export this resulting table to a CSV. This function is apparently known to be broken based on some of the other answers I've seen. I'm only receiving the first column of output. Is there a ready way to do what I need?

Re: Export from counttable broken

dmaislin_splunk — Thu, 09 Aug 2012 20:31:33 GMT

Did you mean outputcsv

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputcsv

Re: Export from counttable broken

timbCFCA — Thu, 09 Aug 2012 20:33:51 GMT

@dmaislin_splunk - I'm rendering a count table in Splunk. I want to save this table to my local drive.

Re: Export from counttable broken

dmaislin_splunk — Thu, 09 Aug 2012 20:36:45 GMT

Never used that command before, so this command aye?

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Contingency

Re: Export from counttable broken

dmaislin_splunk — Thu, 09 Aug 2012 20:40:41 GMT

So can't you just run

host=XX OR host=YY print evtid="10" splunk_server="ami" | counttable evtuser, Printer_Name | outputcsv myfile

Then the results are written to: '$SPLUNK_HOME/var/run/splunk/myfile.csv'