How do I export data out of splunk for external reporting

[samdeva]

I am looking to extract data out of splunk for historical reporting purpose and to integrate with other large reporting data sources. Can some one tell me how best to export data out of splunk in an automated fashion (APIs, Web Services, etc. so that we can pull at regular frequency). Thanks.

[lassesen]

Paul, is there any chance of getting an ODBC connector to splunk where you can simply give it the query and it pulls back a dataset?

[psanford_splunk]

Hi samdeva - I can help with this request. We are building out a new Python SDK and significant updates to our REST API documentation. Send me an email @: psanford@splunk.com.

Paul

[Ayn]

Easiest way would be to use Splunk's CLI search:

$SPLUNK_HOME/bin/splunk search yoursearch -maxout 0

and then grab the output in one way or another. This could be done locally on your Splunk box or remotely from some other box that you want to use for retrieving the events. More information on this is available in the docs, see for instance:

http://www.splunk.com/base/Documentation/4.1.6/Admin/AbouttheCLI

and

http://www.splunk.com/base/Documentation/latest/Developer/UseRemoteCLI

Alternatively, you could retrieve the events through Splunk's REST API. There are SDK's available for a number of languages including Python and Java so you should be able to get it up and running quickly. See http://www.splunk.com/base/Documentation/latest/Developer/RESTIntro