Getting Data In

How to export CSV from Splunk to a third-party system in batch mode?

koshyk
Super Champion

We have a requirement to send Splunk processed data as a CSV to a third-party system. Currently the CSV file is sent via email, but we want it to be kept in a shared location (or folder) where Control-M (or a similar batch processing system) can move the file for other purposes.

My understanding of sending or exporting to a third-party via Splunk is the following:

(a) Could send as syslog to external system (but that will be events)
(b) Could send as alerts (again events)
(c) Could send CSV file but as email attachment

Is there an option to do option (c) like an export/dump into an external filesystem? Has anyone tried this or done a custom output export script?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add | outputcsv foo to the end of your search to save the results to $SPLUNK_HOME/var/run/splunk/csv/foo.csv.

---
If this reply helps you, Karma would be appreciated.

koshyk
Super Champion

But that's still within Splunk's filesystem. outputcsv was ideal if it had an option for filepath

Ideally i'm looking for

|outputcsv {destination_server}:{destination_file_location}

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no option to save files in another location. Perhaps you could make a symlink work, but I'd just have a utility monitor $SPLUNK_HOME/var/run/splunk/csv/foo.csv and move the file to the final location.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...