Getting Data In

Splunk search result to csv format

hemendralodhi
Contributor

Hello,

We have requirement to have Splunk search/dashboard result data in csv format to be fed into another tool. There should not be any manual process- search should run at scheduled time provide result to be picked by another tool.

Options:

1) The tool can pick the csv file generated from search using outputcsv command but in doc it was written that it is not supported in distributed env. So if any other node run the search it will written local to that search node. Tool need to check all the nodes for the file. This can be done based on script checking the timestamp of the file generated and pulling it.

2) Can query write the data into separate index in csv format and tool can use Splunk API details to pull up the data?

Are there any other ways to implement this and which might be the best option?

Thanks
Hemendra

0 Karma

493669
Super Champion

You can try:

<some serch query>....|outputlookup test.csv

It will save your search query results into test.csv file and it will get replicated to all search heads (supported in distributed environment).
Then when you want use that csv file to pick up by another tool then you can try below query:

|inputlookup test.csv|table... <some search query> 
0 Karma

pradeepkumarg
Influencer

You can use outputlookup instead of outputcsv. The file should then replicate all to all the nodes provided you are running search head cluster

The best way is to run the search via Splunk Rest API and get the results

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...