Getting Data In

Splunk search result to csv format

hemendralodhi
Contributor

Hello,

We have requirement to have Splunk search/dashboard result data in csv format to be fed into another tool. There should not be any manual process- search should run at scheduled time provide result to be picked by another tool.

Options:

1) The tool can pick the csv file generated from search using outputcsv command but in doc it was written that it is not supported in distributed env. So if any other node run the search it will written local to that search node. Tool need to check all the nodes for the file. This can be done based on script checking the timestamp of the file generated and pulling it.

2) Can query write the data into separate index in csv format and tool can use Splunk API details to pull up the data?

Are there any other ways to implement this and which might be the best option?

Thanks
Hemendra

0 Karma

493669
Super Champion

You can try:

<some serch query>....|outputlookup test.csv

It will save your search query results into test.csv file and it will get replicated to all search heads (supported in distributed environment).
Then when you want use that csv file to pick up by another tool then you can try below query:

|inputlookup test.csv|table... <some search query> 
0 Karma

pradeepkumarg
Influencer

You can use outputlookup instead of outputcsv. The file should then replicate all to all the nodes provided you are running search head cluster

The best way is to run the search via Splunk Rest API and get the results

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...