Finding reports via the cli

[David_M]

Hello,

I setup 2 reports to run early this AM.  Looks like both reports ran according to splunk.  The problem I have now is finding the actual .csv files on the splunk server so I can scp them.

Thank...

[livehybrid]

Hi @David_M 

Did you use outputcsv, or some other method for exporting the csv such as using the "Output results to lookup" alert action?

As previously mentioned - the output path for outputcsv is $SPLUNK_HOME/var/run/splunk/csv - however these files are not replicated across the cluster if you are running a SHC. 

If you're using the outputcsv, can you confirm you arent using dispatch=true ? If you are you then your job will be in $SPLUNK_HOME/var/run/splunk/dispatch/<job id>/csv

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat · Accepted solution]

@David_M 

By default, when a Splunk report generates a CSV file (e.g., using the outputcsv command or scheduled report export), the files are saved in the $SPLUNK_HOME/var/run/splunk/csv directory on the search head where the report was executed.

$SPLUNK_HOME is typically /opt/splunk on Linux systems, so the full path would be /opt/splunk/var/run/splunk/csv/.

Navigate to this directory using a terminal:

cd /opt/splunk/var/run/splunk/csv
ls -l

Look for files with a .csv extension. The file names might correspond to the report name, search job ID, or a custom name specified in the report configuration

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Outputcsv

Please refer to this for more details, as highlighted by @gcusello : 

https://community.splunk.com/t5/Getting-Data-In/Is-there-anyway-to-generate-and-store-CSV-files-in-a... 

[David_M]

Hi Kiran,

Yea adding the outputcsv command fixed the issue.

Thanks!

David

[kiran_panchavat]

@David_M  Good to know that adding the outputcsv command resolved the issue.

[David_M]

Hi Kiran,

Well I checked the directory mentioned in the posts and the files aren't there for some reason.

David

[kiran_panchavat]

@David_M 

Verify that the reports are configured to generate CSV files. In Splunk Web, go to Settings > Searches, Reports, and Alerts, find your reports, and check their settings.

you have two choices:

1) schedule an alert adding csv as attachment, to receive the csv via email.

2) you could schedule a report adding the outputcsv command at the end.

In this way, you save your report as csv in a pre-defined folder (not changeable!).