How to send Splunk report to Unix server


Hi Team,

I'm generating a report weekly and sending it across as an email.
However, the team wants this file to be pushed onto a directory on Unix server.

Any idea on how I can achieve this?

0 Karma

Esteemed Legend

Assuming not SHC, create a cron job in the OS of the Search Head that runs every X-minutes looking in the dispatch directory for files named XFERME_<destination>_<real_name_starts_here>.csv which does sftp then rm. Create them using |outputcsv.

0 Karma


sorry couldnt get this.

Currently I'm spitting certain piece of info on logs and delimitting it using '|' character.
From Splunk search using regex_raw , eval and split i'm getting the desired data generated in columns.
I have added a report and scheduled it to send on necessary mail ID everyday using schedule -> actions in reporting.

However now the team wants the same report to be pushed on to a FTP server location. How can i acheive this ?

0 Karma


One option is to create your custom alert action (Ref to achieve this, in this option you need to write script.

Other option is, this add-on might work but I never tried this add-on.

0 Karma

Super Champion
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...