Getting Data In

How to export CSV from Splunk to a third-party system in batch mode?

koshyk
Super Champion

We have a requirement to send Splunk processed data as a CSV to a third-party system. Currently the CSV file is sent via email, but we want it to be kept in a shared location (or folder) where Control-M (or a similar batch processing system) can move the file for other purposes.

My understanding of sending or exporting to a third-party via Splunk is the following:

(a) Could send as syslog to external system (but that will be events)
(b) Could send as alerts (again events)
(c) Could send CSV file but as email attachment

Is there an option to do option (c) like an export/dump into an external filesystem? Has anyone tried this or done a custom output export script?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add | outputcsv foo to the end of your search to save the results to $SPLUNK_HOME/var/run/splunk/csv/foo.csv.

---
If this reply helps you, Karma would be appreciated.

koshyk
Super Champion

But that's still within Splunk's filesystem. outputcsv was ideal if it had an option for filepath

Ideally i'm looking for

|outputcsv {destination_server}:{destination_file_location}

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no option to save files in another location. Perhaps you could make a symlink work, but I'd just have a utility monitor $SPLUNK_HOME/var/run/splunk/csv/foo.csv and move the file to the final location.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...