Reporting

How to send Splunk report to Unix server

aqaadi
Engager

Hi Team,

I'm generating a report weekly and sending it across as an email.
However, the team wants this file to be pushed onto a directory on Unix server.

Any idea on how I can achieve this?

0 Karma

woodcock
Esteemed Legend

Assuming not SHC, create a cron job in the OS of the Search Head that runs every X-minutes looking in the dispatch directory for files named XFERME_<destination>_<real_name_starts_here>.csv which does sftp then rm. Create them using |outputcsv.

0 Karma

aqaadi
Engager

sorry couldnt get this.

Currently I'm spitting certain piece of info on logs and delimitting it using '|' character.
From Splunk search using regex_raw , eval and split i'm getting the desired data generated in columns.
I have added a report and scheduled it to send on necessary mail ID everyday using schedule -> actions in reporting.

However now the team wants the same report to be pushed on to a FTP server location. How can i acheive this ?

0 Karma

harsmarvania57
Ultra Champion

One option is to create your custom alert action (Ref https://docs.splunk.com/Documentation/Splunk/8.0.0/AdvancedDev/ModAlertsIntro) to achieve this, in this option you need to write script.

Other option is, this add-on https://splunkbase.splunk.com/app/4398/ might work but I never tried this add-on.

0 Karma

mayurr98
Super Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...