Getting Data In

How to create a scheduled search to export results as a CSV file to an external share?

andrei_radu
New Member

Hello,

I need to create a scheduled search on a search head and automatically export the results as a .csv file, then copy the file to an external share that is mapped to my Splunk server (Linux).

I was trying to use CLI splunk search. Ran the command:

splunk search "search string" > -format csv > /myshare/file_name.csv

This works super fine, can be added to crontab, but the problem is that it requires authentication. If I manually authenticate for the first time then add the search into crontab, it will ask for credentials again?

Otherwise, can you suggest any other methods of automatically exporting search results into a file, then copy a file to an external share?

Thanks a lot!

0 Karma

anantdeshpande
Path Finder

Do you have solution now?

0 Karma

somesoni2
Revered Legend

Try like this

1) Add command ...| outputcsv to your search. This will export the search results to location $SPLUNK_HOME/var/run/splunk/csv
https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Outputcsv

2)Save your search as scheduled saved search and run it at your convenient cron schedule

3) Configure this saved search to run a script as the alert action (alert condition always).

4) Create script (which will run as part of alert action) to copy the exported file from $SPLUNK_HOME/var/run/splunk/csv to your external share.

deva1995
Explorer

Can anyone share the script for copying the file to external server?

0 Karma

mayankm21
New Member

Did you implement this? Can you please share the script? 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...