Reporting

outputcsv: can I tell it where to create the CSV

davesplunkmonky
Splunk Employee
Splunk Employee

instead of /var/run/splunk? I would like to stay away from having to point to or move the file in a script.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is not. You can create a script that is triggered after the search is done and the outputcsv has written the file and explicitly put it into a Splunk bin folder to do this, but you probably knew that.

Part of the reason is security related, to prevent search users from being able to have Splunk create files in arbitary locations.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is not. You can create a script that is triggered after the search is done and the outputcsv has written the file and explicitly put it into a Splunk bin folder to do this, but you probably knew that.

Part of the reason is security related, to prevent search users from being able to have Splunk create files in arbitary locations.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!