Getting Data In

How do I output to text (csv or json) per-minute that aggregates continuously in real time?

gerberm
New Member

How do I output to text (csv or json) per-minute aggregates continuously in real time? The resulting file will be scraped continuously by another tool.

0 Karma

martynoconnor
Communicator

In Splunk, write your search which generates the data you need, and then presents it in a tabular format that you'd like the CSV to be in. Then, at the end of your search, use |outputcsv append=true - which will place the csv file on the filesystem in /opt/splunk/var/run

The documentation is here - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputcsv

The major important difference between using outputlookup and outputcsv is that as the csv grows in size, had you used outputlookup you will be potentially replicating that large file between clustered search heads. If you just want an external tool to monitor it, use outputcsv instead.

Regards,

Martyn

0 Karma

gerberm
New Member

Thanks but that answer doesn't adress the continuous aspect.
I have "...| bin _time span=1m | table _time, A, B | outputcsv append-true myfile" and that works when I run it as a search directly in the UI. Saving it as a report with a cron schedule of "* * * * *" doesn't appear to do anything. No csv is generated. The outputcsv part appears to get stripped off.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...