Deployment Architecture

How to push a report result.txt file created in Splunk to a remote location?

shivarpith
Path Finder

Hi,

We have a few reports running in Splunk for stats count of a certain type of events. We are successfully generating a txt file using | outputcsv results.txt but this file is created in a var/run/splunk, whereas we need this file to be pushed to a remote server where it can further travel to fulfill its purpose.

is there a way, please help

Thanks

Tags (3)
0 Karma

jensonthottian
Contributor

Splunk has no default command to have the results sent to a remote location. You can use either of the below two approaches :

  1. Create a python script which will take a file as input and scp to remote location. Now add this script as a command (i.e securecopy)in Splunk by making entries in commands.conf and authorize.conf . Use this is command after your search string |securecopy results.txt

  2. Create a cron which continuously poll for any new *.txt created recently and will scp to remote location.

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...