Splunk Dev

Need to find outputcsv subroutine python file

ShaneNewman
Motivator

I have a savedsearch that needs to run and output a physical file, which a file name that contains a variable with the date in a particular format. I have the search, which works great... The issue I have is with where the outputcsv command puts the csv file that is generated (SPLUNK_HOME\var\run\splunk). I need to move this to either SPLUNK_HOME\apps\app_name\lookups or completely out of the Splunk directory, which will be the end result anyway.

I need to know the name of the *.py file in Splunk that contains the script for the outputcsv subroutine OR the name of the file that contains the output directory for the outputcsv subroutine. I can handle it from there, I have just not been successful in locating this python script.

1 Solution

kallu
Communicator

Would Outputlookup work better than outputcsv ?

(or you can extend splunk with your own output -cmd that lets you specify directory & filename, and creates a huge security issue too 🙂

View solution in original post

ShaneNewman
Motivator

I appreciate that... Any luck as of yet?

0 Karma

kallu
Communicator

Would Outputlookup work better than outputcsv ?

(or you can extend splunk with your own output -cmd that lets you specify directory & filename, and creates a huge security issue too 🙂

ShaneNewman
Motivator

Until we figure out exactly where this script lives, we have a PowerShell script running on a regular basis to move the files from the app folder to a shared folder that has been setup.

0 Karma

sowings
Splunk Employee
Splunk Employee

It may not BE a script, it could be built-in. I'll dig.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...