topic Re: How do I pipe splunk query output to a file? in Splunk Search

How do I pipe splunk query output to a file?

Alan_Bradley — Sat, 20 Mar 2010 01:25:27 GMT

How do I take output (say . . . "View Sources") and pipe it to a file?

Re: How do I pipe splunk query output to a file?

matt — Sat, 20 Mar 2010 01:28:00 GMT

You have couple of options. The basic is simply using redirect to file, you can also use the -format flag.

./splunk search '*' -format csv > file-name

Valid types are: custom, normal, xml, csv, table You can also use one of the output search commands:
http://www.splunk.com/base/Documentation/3.4.9/User/UnsupportedSearchCommands#outputcsv
http://www.splunk.com/base/Documentation/3.4.9/User/UnsupportedSearchCommands#outputraw
and the other outputtxt outputxml

Or the export option from the GUI or CLI: http://www.splunk.com/base/Documentation/3.4.9/Admin/ExportEventData

Re: How do I pipe splunk query output to a file?

jameshfisher — Fri, 25 Jul 2014 15:10:45 GMT

Doesn't work. WARN: The following arguments were unknown or had no effect: 'format'

Re: How do I pipe splunk query output to a file?

barakreeves — Mon, 28 Sep 2020 17:11:00 GMT

Here is the updated syntax and related doco link:
/splunk search "index=_* audit" -output 'csv' > /var/share/splunk_output/20140724-audit.csv

doco link: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/CLIsearchsyntax

Re: How do I pipe splunk query output to a file?

mIliofotou_splu — Thu, 22 Sep 2016 04:04:07 GMT

For Splunk 6.4.x:
Here is a list of different option for exporting to a file from the CLI

$SPLUNK_HOME/bin/splunk search 'index=main' -output table > tofile.txt
$SPLUNK_HOME/bin/splunk search 'index=main | head' -output raw > tofile.txt
$SPLUNK_HOME/bin/splunk search 'index=main | head' -output rawdata > tofile.txt
$SPLUNK_HOME/bin/splunk search '*' -output csv > tofile.txt
$SPLUNK_HOME/bin/splunk search 'index=main id=abs*' -output json > tofile.txt

The default behavior of the CLI search is to export first 100. Use the -maxout 0 option to bypass that limit.



$SPLUNK_HOME/bin/splunk search 'index=main id=abs*' -output json -maxout 0 > tofile.txt

If you don't specify an output option, the default is to only export _raw.