After using outputcsv in a Splunk search, where is this CSV file located?

[asarran]

Hey Splunkers

I'm new to Splunk and I'm having issues attempting to export a search results to a CSV file.

<MY SEARCH> | outputcsv  mycsvfilename

The trouble I'm having is the ability to locate the CSV file on my desktop. I can't find the file. The assumption is that the file is being sent somewhere else? I'm curious if anyone has ever encountered a problem similar to this before.

Thank You,

[Raghav2384 · Accepted solution]

Hello @asarran,

Please take a look : https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Outputcsv

If you have Splunk Enterprise, this command saves search results to the specified CSV file on the local search-head in the $SPLUNK_HOME/var/run/splunk/csv directory. Updates to $SPLUNK_HOME/var/run/*.csv using the outputcsv command are not replicated across the cluster.

You can then add that csv back as a lookup or monitoring that directory for *.csv if outputcsv is something you use very often. Hope this helps

Hope this Helps!

Thanks,
Raghav

[asarran]

interesting, unfortunately I currently don't have access to the command interface of the header. I'm wandering would there be any other means I can export this query to a csv file on my desktop. I believe one option would be to schedule a report and have the report be emailed. I'm curious is there another method that is available?

Thanks, Raghav

[somesoni2]

You should be able to export the search result manually (if running the search on ad-hoc basis). See this

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Exportsearchresults#Export_data_using_Splun...

[asarran]

Thank You.