Getting Data In

How do I output to text (csv or json) per-minute that aggregates continuously in real time?

New Member

How do I output to text (csv or json) per-minute aggregates continuously in real time? The resulting file will be scraped continuously by another tool.

0 Karma


In Splunk, write your search which generates the data you need, and then presents it in a tabular format that you'd like the CSV to be in. Then, at the end of your search, use |outputcsv append=true - which will place the csv file on the filesystem in /opt/splunk/var/run

The documentation is here -

The major important difference between using outputlookup and outputcsv is that as the csv grows in size, had you used outputlookup you will be potentially replicating that large file between clustered search heads. If you just want an external tool to monitor it, use outputcsv instead.



0 Karma

New Member

Thanks but that answer doesn't adress the continuous aspect.
I have "...| bin _time span=1m | table _time, A, B | outputcsv append-true myfile" and that works when I run it as a search directly in the UI. Saving it as a report with a cron schedule of "* * * * *" doesn't appear to do anything. No csv is generated. The outputcsv part appears to get stripped off.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...