Dashboards & Visualizations
Highlighted

Export Splunk results to an XML output?

Builder

Is there a way to export Splunk results from a Report, chart...etc to an XML based output?

I noticed that someone was trying to accomplish this but there wasn't enough information on the approach of how he was achieving this: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command

0 Karma
Highlighted

Re: Export Splunk results to an XML output?

Ultra Champion

Not an export as such, but you could invoke the search using the REST api.

0 Karma
Highlighted

Re: Export Splunk results to an XML output?

Builder

So I can extract the events and arrange them by there field names using a python script to do so?

0 Karma
Highlighted

Re: Export Splunk results to an XML output?

Builder

Ok, I have found out that there is an automated feature in splunk that allows you to export your results at a Click of a Button ( Basically the Action Menu 😛 ).

I also discovered with Damien's help that I can play around with it using the REST API, via a Python Script so that I may Modify the XML to the way I want it to look.

But Im not exactly %100 sure that if you can Modify the OutPut XML to your requirements?, can this be done?, has anyone ever tried this?, again the only person I found that actually engaged in performing this the way I want to is MW with his question: http://splunk-base.splunk.com/answers/13739/output-xml-via-a-custom-search-command

0 Karma
Highlighted

Re: Export Splunk results to an XML output?

Ultra Champion

I'm not sure about the feasibility of modifying the schema of the response XML.
But as you mention, from your python script, you could use the Splunk Python SDK and then transform the original result XML from the REST call into an XML format to suit your specific requirements.

0 Karma
Highlighted

Re: Export Splunk results to an XML output?

Communicator

Hi All,

Looks like this can be done via splunkweb,CLI,REST API,SDK's & Dump commands. PFB link for more information:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Search/Exportsearchresults

0 Karma