Export Splunk results to an XML output?

[Dark_Ichigo]

Is there a way to export Splunk results from a Report, chart...etc to an XML based output?

I noticed that someone was trying to accomplish this but there wasn't enough information on the approach of how he was achieving this: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command

[bharathkumarnec]

Hi All,

Looks like this can be done via splunkweb,CLI,REST API,SDK's & Dump commands. PFB link for more information:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Search/Exportsearchresults

[Dark_Ichigo]

Ok, I have found out that there is an automated feature in splunk that allows you to export your results at a Click of a Button ( Basically the Action Menu 😛 ).

I also discovered with Damien's help that I can play around with it using the REST API, via a Python Script so that I may Modify the XML to the way I want it to look.

But Im not exactly %100 sure that if you can Modify the OutPut XML to your requirements?, can this be done?, has anyone ever tried this?, again the only person I found that actually engaged in performing this the way I want to is MW with his question: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command

[Damien_Dallimor]

I'm not sure about the feasibility of modifying the schema of the response XML.
But as you mention, from your python script, you could use the Splunk Python SDK and then transform the original result XML from the REST call into an XML format to suit your specific requirements.

[Damien_Dallimor]

Not an export as such, but you could invoke the search using the REST api.

[Dark_Ichigo]

So I can extract the events and arrange them by there field names using a python script to do so?