Reporting

Error in outputcsv command: could not write to file

dbryan
Path Finder

Related to this question:

When I run:

search * | head 10 | /home/splunk/test/aaa.csv

I see this error:

Could not write to file '/home/splunk/test/aaa.csv

More info:

  • Splunk is running as the owner of the directory
  • the owner has read and write permissions
  • the directory is on the same filesystem as $SPLUNK_HOME

Anyone have any idea what this could be?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Outputcsv will only write files to splunk's var/run/splunk directory, for security reasons. It will not write to arbitrary file system locations. You could, I believe, create a symlink (or hard link) to a directory under there and write to that location however.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Outputcsv will only write files to splunk's var/run/splunk directory, for security reasons. It will not write to arbitrary file system locations. You could, I believe, create a symlink (or hard link) to a directory under there and write to that location however.

View solution in original post

stephenho
Path Finder

Have you created the csv lookup file under
manager -> lookups -> lookup table files -> new ?

Also, I think your syntax is wrong, and what you actually want to type is

search * |head 10| outputcsv csvfilename.csv 

csvfilename.csv being the name of the file you created in the first step.

See if that works for you.

0 Karma

dbryan
Path Finder

Indeed, I meant to have outputcsv there.

outputcsv doesn't require a lookup table to be created though. I think you're thinking of outputlookup.

It works if I give it a relative path like "filename.csv", but not an absolute path. I'm trying to automate delivery of reports to a shared drive.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!