Getting Data In

How can I identify the full path to the output file of a dump command?

garywiner
New Member

I am being forced to output my saved search results in .tsv format, so it appears that the dump command is the way to go.

But how can I identify the full path to the file that I created under var/run/splunk/dispatch so that I can grab the results programmatically before it disappears? I have experimented with the _dstpath variable and only succeeded in burying the file that I want to retrieve deeper under the dispatch/ directory.

Has anyone done this successfully before? I'm sure it's a fairly simple unix solution that I have no experience with ...

0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search

| rest /services/search/jobs | table sid title | search title="yourSavedSearchName"  | head 1

The dump command will save the file on disk at

`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/` 

directory so your can take the result of above search (sid field) and replace it above

View solution in original post

somesoni2
Revered Legend

Assuming your're using scheduled saved search to do the export, you would be able to get the sid using following search

| rest /services/search/jobs | table sid title | search title="yourSavedSearchName"  | head 1

The dump command will save the file on disk at

`$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/` 

directory so your can take the result of above search (sid field) and replace it above

woodcock
Esteemed Legend
0 Karma

garywiner
New Member

I would love to do that and join everyone in the 21st century, but my client is insisting on a tab-separated values format in the output file.

0 Karma

woodcock
Esteemed Legend

Once your outputcsv is done (and we know exactly where it will be), you can just do this to convert CSV to TSV before you ftp it to wherever:

sed "s/,/\t/g" MyOutputFile.csv > MyOutputFilte.tsv
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>