Splunk Data Export

[scout29]

We have a lookup in Splunk that we are looking to send a few columns in the lookup to another product via a POST API call. My question is, are there any Splunk add-ons that i can leverage to do this? I see there is an HTTP alert action that can make a POST, however with this being a lookup (csv) i am not sure it will work correctly. 

[marnall]

That should be doable. Does the other product have documentation describing the format in which it expects to receive the lookup? You should be able then to use SPL to convert the lookup into that format, in one or more fields, then send it using the POST HTTP alert action.

[isoutamo]

Hi

there are at least this one https://splunkbase.splunk.com/app/5927. Not exactly what you are looking for, but probably it gives you some ideas how to do it.

Basically you can do it as you said alert action (could be an issue, if you want sent lot of data?). Another way is to create a custom command and use it. But If. you have lot of data to export, then maybe easiest way to go is just create saved search, call it with splunk rest api with some other job management software/system which then send it forward.

r. Ismo