Hallo,
i want to execute daily a shell-script, that copys data to the csv-dir from Splunk.
Is it a good way to do this with splunk, or should i use therefore linux-cron.
please send me the necessary file to do this, thank you
Regards Gerd
Hello,
If the trigger of the execution of the script is based on search results, then you can use Splunk alerts to achieve this.
After you search is completed, click on Save As -> Alert -> Add Actions -> Run a script -> type script name.
Location of script:
$SPLUNK_HOME/bin/scripts
Regards
Hello,
If the trigger of the execution of the script is based on search results, then you can use Splunk alerts to achieve this.
After you search is completed, click on Save As -> Alert -> Add Actions -> Run a script -> type script name.
Location of script:
$SPLUNK_HOME/bin/scripts
Regards
There is no native way to do this in Splunk but there might be an app on splunkbase to do this. We always setup a cron job to copy anything with a particular prefix to the transfer directory (stripping the prefix from the filename), just like you are suggesting.
Hi gerdhuber,
sorry but I don't understand your question:
To do the first choice, you don't need cron, you can schedule a search (e.g. using an alert) that export the results of a Splunk search in a csv file.
To export the result of a Splunk search in a csv file you can add at the end of your search the outputcsv command (see http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Outputcsv).
Remember that the folder where you can find csv files is fixed: $SPLUNK_HOME/var/run/splunk/csv
If instead you want to copy a csv file from a folder into another one you have to use cron.
Bye.
Giuseppe