Export search results to a folder outside splunk

[DineshElumalai]

Hello Everyone

I need to export the search results to a folder outside the Splunk. To do this job we've exportresults in Splunk which works fine. Basically in my scenario, it is a saved search which runs every week and data has been exported to the folder but it creates a new folder. I need to append the search results to the existing file or else I need to replace the file with the new data. 

If I get result for any one of the things mentioned above. I'm good. Thanks.

[Prewin27]

@DineshElumalai 
Are you using splunk native csv export? or using any script or rest api to export the results?
If you are using outputcsv i agree with @gcusello  export the result to splunk folder and create a script to move to your folder.

Also you can consider using exporting data using rest api with curl.
curl -k -u <username>:<password> https://<splunk-host>:8089/services/search/jobs/export \
-d search="search index=test sourcetype=test earliest=-7d@d latest=now" \
-d output_mode=csv > /external/path/to/destination/results.csv

To append new results to an existing file, use >> instead of >

curl -k -u <username>:<password> https://<splunk-host>:8089/services/search/jobs/export \
-d search="search savedsearch test_weekly_export" \
-d output_mode=csv >> /path/to/your/target/folder/test_report.csv

#https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.3/export-search-results/export-d...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PickleRick]

You can use this app - https://splunkbase.splunk.com/app/5738

But it seems to have support for many destinations... except local file. You can get around it by connecting back to the host you're running your Splunk instance on.

[gcusello]

Hi @DineshElumalai ,

I suppose that you're speaking of exportcsv, that is usually exported in the $SPLUNK_HOME/var/run/splunk/csv folder (export folder isn't configurable) and than you can use it.

If you export using the same name the file is overwritten, if the file is saved in a different folder maybe there is some customization (e.g. a script that moves the file).

Ciao.

Giuseppe