You should develop your script using the python interpreter that ships with Splunk. That's the one that Splunk will use to run your script. Have the script write the CSV file to your app's lookups directory ($SPLUNK_HOME/etc/apps//lookups). Then your searches can use the inputlookup command to get the data. One drawback to this approach is you will always have only the most recent data set - there's no going back in time to see how things changed. Another approach is to have the script write the CSV file to a directory monitored by Splunk ( [monitor:///path/to/file] in inputs.conf). That will give you a new set of data every time your script runs. Dashboard searches would then need to use an appropriate SPL command to fetch only the latest data. For example, if your script runs every hour, then the search could specify earliest=-1h to get only the last hour's data. ... View more