Reporting

How to secure copy (SCP) saved search results on ServerA to ServerB?

tkwaller
Builder

Hello

I am trying to figure out how I can do this:
I have a saved search that runs on server A and I want to secure copy (scp) those results to server B. How can I accomplish this? I know that I can have a script execute after the search is run, but all I want to do is simply scp the results from one folder to a different folder on a different server.

Any ideas on how I can do this?

Thanks for the assistance!

Tags (2)
1 Solution

fdi01
Motivator

Syntaxe to use SCPcommand(first install SSH on ServerA and ServerB).

to Copy an file from serveurA to serveurB:
> scp LoginA@ServerA:pathA/file_nameA LoginB@ServerB:pathB/file_nameB

to Copy an file from curent directory to another server directory :
> scp File login@server:path

to Copy an directory , with these sub-directory, to an sever directory :

> scp -r directory login@server:path

in you case you can copy your saved_search directory try like this:

> scp -r your_login_nameA@serverA.com:/etc/splunk/.../saved_search_nameA/  your_login_nameB@serverB.com:/etc/splunk/.../saved_search_nameB/

or to copy saved_search file:

> scp  your_login_nameA@serverA.com:/etc/splunk/.../saved_search_file  your_login_nameB@serverB.com:/etc/splunk/.../saved_search_directory/

View solution in original post

fdi01
Motivator

Syntaxe to use SCPcommand(first install SSH on ServerA and ServerB).

to Copy an file from serveurA to serveurB:
> scp LoginA@ServerA:pathA/file_nameA LoginB@ServerB:pathB/file_nameB

to Copy an file from curent directory to another server directory :
> scp File login@server:path

to Copy an directory , with these sub-directory, to an sever directory :

> scp -r directory login@server:path

in you case you can copy your saved_search directory try like this:

> scp -r your_login_nameA@serverA.com:/etc/splunk/.../saved_search_nameA/  your_login_nameB@serverB.com:/etc/splunk/.../saved_search_nameB/

or to copy saved_search file:

> scp  your_login_nameA@serverA.com:/etc/splunk/.../saved_search_file  your_login_nameB@serverB.com:/etc/splunk/.../saved_search_directory/

tkwaller
Builder

Worked great. Now do you know how this could be automated?

0 Karma

hemendralodhi
Contributor

Run a cron script on server where reports are saved. Make sure to use cron internal which send report after report search schedule.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...