outputcsv export directory

[henry_ty_leung]

Hi There,

Just wondering if i can change the export directory (i.e F:\ExportResults) using outputcsv command ?

Thanks
Henry

[MuS]

Hi henry_ty_leung,

No you cannot.
You could create a custom script that is triggered after the search is done and the outputcsv has written the file and explicitly put it into a Splunk bin folder to move / copy file to the final directory http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/AddthecustomcommandtoSplunk

The reason why this was done, is partly security related; to prevent search users from being able to have Splunk create files in arbitrary locations.

hope this helps ...

cheers, MuS