Splunk Cloud Platform

Is there any way we can store CSV file back to source path directory or any other directory?

cbiraris
Path Finder

Hi Team,

is there any way we can store CSV file back to source path directory or any other directory ?

I am trying create a alert with having "Output results to lookup". is there any way we can store the created .CSV at shared  directory ?

Please advise

Thank you.

Labels (1)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

The answer is both "no" and "yes". (with the latter not applicable to the Cloud environment)

No, because by default you can output the results to a lookup which means storing them in a file backing this lookup - somewhere under $SPLUNK_HOME.

Yes, because you can write your own alert action (see the dev portal for details) which would write the file somewhere else.

Remember though that if your environment has a search-head cluster, you're generating output on the one SH on which the saved search wash dispatched to so it wouldn't be very convenient to dig through several servers to find where exactly the file was written to.

It also depends on what you mean by "shared directory".

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For security, Splunk restricts where it will write CSV files.  Perhaps you can set up a daemon to copy the files to the shared directory.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...