Reporting

Error in outputcsv command: could not write to file

dbryan
Path Finder

Related to this question:

When I run:

search * | head 10 | /home/splunk/test/aaa.csv

I see this error:

Could not write to file '/home/splunk/test/aaa.csv

More info:

  • Splunk is running as the owner of the directory
  • the owner has read and write permissions
  • the directory is on the same filesystem as $SPLUNK_HOME

Anyone have any idea what this could be?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Outputcsv will only write files to splunk's var/run/splunk directory, for security reasons. It will not write to arbitrary file system locations. You could, I believe, create a symlink (or hard link) to a directory under there and write to that location however.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Outputcsv will only write files to splunk's var/run/splunk directory, for security reasons. It will not write to arbitrary file system locations. You could, I believe, create a symlink (or hard link) to a directory under there and write to that location however.

stephenho
Path Finder

Have you created the csv lookup file under
manager -> lookups -> lookup table files -> new ?

Also, I think your syntax is wrong, and what you actually want to type is

search * |head 10| outputcsv csvfilename.csv 

csvfilename.csv being the name of the file you created in the first step.

See if that works for you.

0 Karma

dbryan
Path Finder

Indeed, I meant to have outputcsv there.

outputcsv doesn't require a lookup table to be created though. I think you're thinking of outputlookup.

It works if I give it a relative path like "filename.csv", but not an absolute path. I'm trying to automate delivery of reports to a shared drive.

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...