How to export CSV from Splunk to a third-party system in batch mode?

[koshyk]

We have a requirement to send Splunk processed data as a CSV to a third-party system. Currently the CSV file is sent via email, but we want it to be kept in a shared location (or folder) where Control-M (or a similar batch processing system) can move the file for other purposes.

My understanding of sending or exporting to a third-party via Splunk is the following:

(a) Could send as syslog to external system (but that will be events)
(b) Could send as alerts (again events)
(c) Could send CSV file but as email attachment

Is there an option to do option (c) like an export/dump into an external filesystem? Has anyone tried this or done a custom output export script?

[richgalloway]

Add | outputcsv foo to the end of your search to save the results to $SPLUNK_HOME/var/run/splunk/csv/foo.csv.

[koshyk]

But that's still within Splunk's filesystem. outputcsv was ideal if it had an option for filepath

Ideally i'm looking for

|outputcsv {destination_server}:{destination_file_location}

[richgalloway]

There is no option to save files in another location. Perhaps you could make a symlink work, but I'd just have a utility monitor $SPLUNK_HOME/var/run/splunk/csv/foo.csv and move the file to the final location.