What is the best way to create automated reports from multiple search outputs?

[smcdonald20]

I use the CSV exports of 10-12 search results each month to create an Excel report.

I am manually exporting the results, then saving them in a location on my PC, then running an Excel macro that pulls all of the exports into one file and formats the data.

My question: What is the best way to automate exporting these files to the location?
Is outputcsv the best way, or should I "run a script" to export to my location?

[niketn · Accepted solution]

There are three options you have:

1) Create a Scheduled Report with Send Email action. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports

2) Create a scheduled monthly Alert with Send Email as alert action and attach report generate by Search result as csv or pdf as per your need. Refer to following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Setupalertactions

3) You save Search result as a Table in Dashboard and schedule email as PDF.

In either of the above three cases you have to ensure that Email exchange is properly setup on Splunk Server. There is an option to send test email with PDF delivery as option, in order to check the same. Most of email alert setup configuration have been called out in the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification

[smcdonald20]

Thank you, but what I am looking for is a way to automate sending these files to a location on a file server.
Just scheduling to email will still mean manually going and saving all the attachments in the location myself.

Any ideas on the best way to have all of these reports exported and saved to a specific location each month?

[richgalloway]

Why not create a dashboard that contains all of the reports? You could then schedule it for regular delivery as a PDF.

[smcdonald20]

Thanks Rich, but the export has to be in excel format.
Any other ideas?