Is there any way we can store CSV file back to source path directory or any other directory?

[cbiraris]

Hi Team,

is there any way we can store CSV file back to source path directory or any other directory ?

I am trying create a alert with having "Output results to lookup". is there any way we can store the created .CSV at shared  directory ?

Please advise

Thank you.

[PickleRick]

The answer is both "no" and "yes". (with the latter not applicable to the Cloud environment)

No, because by default you can output the results to a lookup which means storing them in a file backing this lookup - somewhere under $SPLUNK_HOME.

Yes, because you can write your own alert action (see the dev portal for details) which would write the file somewhere else.

Remember though that if your environment has a search-head cluster, you're generating output on the one SH on which the saved search wash dispatched to so it wouldn't be very convenient to dig through several servers to find where exactly the file was written to.

It also depends on what you mean by "shared directory".

[richgalloway]

For security, Splunk restricts where it will write CSV files.  Perhaps you can set up a daemon to copy the files to the shared directory.