In Splunk, write your search which generates the data you need, and then presents it in a tabular format that you'd like the CSV to be in. Then, at the end of your search, use |outputcsv append=true - which will place the csv file on the filesystem in /opt/splunk/var/run
The major important difference between using outputlookup and outputcsv is that as the csv grows in size, had you used outputlookup you will be potentially replicating that large file between clustered search heads. If you just want an external tool to monitor it, use outputcsv instead.
Thanks but that answer doesn't adress the continuous aspect.
I have "...| bin _time span=1m | table _time, A, B | outputcsv append-true myfile" and that works when I run it as a search directly in the UI. Saving it as a report with a cron schedule of "* * * * *" doesn't appear to do anything. No csv is generated. The outputcsv part appears to get stripped off.