Search result output

Splunk can output the results of searches executed on SplunkWeb in CSV format under $SPLUNK_HOME/var/run/splunk in the Splunk server.

* Path information of $SPLUNK_HOME (for default installation)
Linux OS: /opt/splunkWindows OS: C:\Program Files\Splunk

output method

Use the outputcsv command to output search results.

Using the outputcsv command, it is possible to save raw data and statistical information obtained from splunk search results in CSV format on the server.

how to use

| outputcsv <保存するファイル名>.csv

Example of use

index=_internal | head 10 | table host,source | outputcsv test.csv

Executing the above command will output a file called test.csv.

Destination

The destination directory for saving the output csv file differs for each version.

Please note that there is no way to change the save destination of the csv file other than changing the version.

How to check output results on SplunkWeb

The CSV file output by the above procedure can be viewed by using the inputcsv command on SplunkWeb.

• Example of using the inputcsv command

Command example

| inputcsv test.csv

By executing the above command, it is possible to display the contents of the test.csv file on the screen.