topic export results to csv in Splunk Search

export results to csv

Justin_Grant — Fri, 26 Mar 2010 03:10:33 GMT

What's the easiest way to export Splunk search results to a CSV file that I can open in Excel?

Re: export results to csv

gkanapathy — Fri, 26 Mar 2010 03:52:52 GMT

If there are fewer than 10,000 lines to export, then "Actions>Export Results..." from the Search or Charting views, after a search has finished running. The menu item is not available on most other dashboards or views.

I think that the "Action" menu is nearly invisible, so lots of people miss it.

Re: export results to csv

hulahoop — Fri, 26 Mar 2010 04:29:11 GMT

Alternatively, try the outputcsv command like this:

splunk > my super cool search | outputcsv mycsvfilename

Re: export results to csv

Justin_Grant — Sat, 27 Mar 2010 04:02:09 GMT

Both of these are good answers, but this one matches more closely what I was trying to do. thanks!

Re: export results to csv

Dan — Wed, 21 Apr 2010 22:07:15 GMT

This is also discussed here: http://blogs.splunk.com/2009/08/07/help-i-cant-export-more-than-10000-events/

Re: export results to csv

gkanapathy — Wed, 21 Apr 2010 22:07:16 GMT

What version of Splunk are you running?

Re: export results to csv

pkaeding — Wed, 11 Apr 2012 00:39:02 GMT

+1 for 'I think that the "Action" menu is nearly invisible, so lots of people miss it.'!

Re: export results to csv

I_am_Jeff — Tue, 19 Mar 2013 15:39:55 GMT

I could not find the "Action" menu in version 4.3.4. There is an "-> Export" link just above list of matching events, though.

Re: export results to csv

I_am_Jeff — Tue, 19 Mar 2013 15:40:20 GMT

This worked well. Myself and a user that could not export a csv files to our desktop. This dropped the file in our pool/var/run/splunk directory. AND the export link worked with this search. (v 4.3.4) I wonder if the initial problem is becauser our pooled search heads are behind a load balancer. . . ?

Re: export results to csv

poojag — Tue, 17 Mar 2015 11:11:22 GMT

I have been trying to export my search query's result to a csv file using 'outputcsv'. But no file is getting created. Not getting any error too.

Here is my search query:

| outputcsv trial.csv

Please help.

Are any settings required to be done to get the CSV output.

Re: export results to csv

peter_krammer — Thu, 10 Sep 2015 15:30:09 GMT

Today I had the Problem that a User wanted to export a CSV with over 13 million lines.
He let the Search run in the background and it took over a day to complete.
Now he could not export his results and I did not want to run the search again with outputcsv.

The solution I came up with was to look on the search head and find the result file for the search:
/opt/splunk/var/run/splunk/dispatch//results.csv.gz

I hope this helps everybody who has the same issue.

Re: export results to csv

dominiquevocat — Wed, 13 Jan 2016 09:43:26 GMT

you could have a look in splunkbase at the TA-XLS which allows in version 0.1 to convert the .csv generated by outputcsv to a Excelsheet and sendfile for sending it as a email attachment. The new version 0.2 has a outputcsv command that directly generates a .xls and allows for sending it via email. (i have trouble uploading the new version right now but in a day or so it should be there).

Re: export results to csv

kalmira — Tue, 07 Feb 2017 20:55:01 GMT

Append "| sort Sourcetype | outputcsv output.csv" to your search.

After the query runs, you should be able to go to $SPLUNK_HOME/ var/run/splunk/csv directory and see output.csv

Re: export results to csv

bergen288 — Fri, 29 Oct 2021 20:54:59 GMT

Where is the default location of CSV output file defined in search string on Windows Server 2016?