Adding IP's to a exposed text file

[arunkuriakose]

Hi Team

I want to collect source ip from an alert triggered /search ran and then add that to a .txt file exposed on a separate server.(https://urlofserver/ipfile.txt)

What is the best way to achieve this

[aasabatini]

Hi @arunkuriakose 

you can add on your alert action an sh script to save all result ip on your txt file.

https://docs.splunk.com/Documentation/Splunk/8.1.3/AdvancedDev/CustomAlertScript

or if in your case works fine a csv file you can add on your alert search the outputlookup comand to save the results in a new csv file.

https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Outputlookup