Clarification on using dump command

[Jananee_iNautix]

There's a requirement to export the search results from Splunk to a custom location in Unix server. The search has to be run periodically and the results should be exported to the custom location.

Could you please confirm if dump command is the one to be used. If so, can we override to a custom location (or) would it go within the following folder by defualt ($SPLUNK_HOME/var/run/splunk/dispatch//dump) with the custom location appended to it by the use of _dstpath=strftime(_time, "%Y%m%d/%H") + "/" + host

[somesoni2]

There are many options to export the search result to a file.

Using Search:

You can add search commands like "outputcsv" OR "outputtext" [output to $SPLUNK_HOME/var/run/splunk], OR "dump" ($SPLUNK_HOME/var/run/splunk/dispatch//dump). These location can't be changed.
To run this periodically just create a saved search.

Using Splunk CLI:

Your can export search result to a file using following command.

splunk search "|savedsearch YourSavedSearchName" -auth username:password -output csv > /your/custom/location/yourfilename.csv

OR

splunk search "index=blah .....your search "  -earliest_time -1h@h -latest_time @h -maxout 0  -auth username:password -output csv > /your/custom/location/yourfilename.csv

You can write a shell script with these command and set the shell script as action of a schedule search.

[Jananee_iNautix]

The field "tmp_dir" is not mentioned in the splunk documentation for dump command.Still when I used it along with the dump command for exporting the search results to a temporary location ,it works.Can you tell whether it is advisable to use it and the reason for its working.

[hexx]

While functional, the "tmp_dir" argument of the "dump" search operator has been deemed unsafe and therefore has been removed in Splunk Enterprise 6.1 and beyond. This also explains why you can't find it as a documented argument.