Deployment Architecture

How to push a report result.txt file created in Splunk to a remote location?

shivarpith
Path Finder

Hi,

We have a few reports running in Splunk for stats count of a certain type of events. We are successfully generating a txt file using | outputcsv results.txt but this file is created in a var/run/splunk, whereas we need this file to be pushed to a remote server where it can further travel to fulfill its purpose.

is there a way, please help

Thanks

Tags (3)
0 Karma

jensonthottian
Contributor

Splunk has no default command to have the results sent to a remote location. You can use either of the below two approaches :

  1. Create a python script which will take a file as input and scp to remote location. Now add this script as a command (i.e securecopy)in Splunk by making entries in commands.conf and authorize.conf . Use this is command after your search string |securecopy results.txt

  2. Create a cron which continuously poll for any new *.txt created recently and will scp to remote location.

Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...