topic Re: How to send Splunk report to Unix server in Reporting

How to send Splunk report to Unix server

aqaadi — Mon, 04 Nov 2019 20:03:36 GMT

Hi Team,

I'm generating a report weekly and sending it across as an email.
However, the team wants this file to be pushed onto a directory on Unix server.

Any idea on how I can achieve this?

Re: How to send Splunk report to Unix server

mayurr98 — Mon, 04 Nov 2019 20:13:34 GMT

This may help you:

https://answers.splunk.com/answers/51140/save-reports-in-shared-folders.html

Re: How to send Splunk report to Unix server

harsmarvania57 — Mon, 04 Nov 2019 20:22:14 GMT

One option is to create your custom alert action (Ref https://docs.splunk.com/Documentation/Splunk/8.0.0/AdvancedDev/ModAlertsIntro) to achieve this, in this option you need to write script.

Other option is, this add-on https://splunkbase.splunk.com/app/4398/ might work but I never tried this add-on.

Re: How to send Splunk report to Unix server

woodcock — Tue, 05 Nov 2019 05:05:52 GMT

Assuming not SHC, create a cron job in the OS of the Search Head that runs every X-minutes looking in the dispatch directory for files named XFERME_<destination>_<real_name_starts_here>.csv which does sftp then rm. Create them using |outputcsv.

Re: How to send Splunk report to Unix server

aqaadi — Tue, 03 Dec 2019 18:01:12 GMT

sorry couldnt get this.

Currently I'm spitting certain piece of info on logs and delimitting it using '|' character.
From Splunk search using regex_raw , eval and split i'm getting the desired data generated in columns.
I have added a report and scheduled it to send on necessary mail ID everyday using schedule -> actions in reporting.

However now the team wants the same report to be pushed on to a FTP server location. How can i acheive this ?