Hello,
We have requirement to have Splunk search/dashboard result data in csv format to be fed into another tool. There should not be any manual process- search should run at scheduled time provide result to be picked by another tool.
Options:
1) The tool can pick the csv file generated from search using outputcsv command but in doc it was written that it is not supported in distributed env. So if any other node run the search it will written local to that search node. Tool need to check all the nodes for the file. This can be done based on script checking the timestamp of the file generated and pulling it.
2) Can query write the data into separate index in csv format and tool can use Splunk API details to pull up the data?
Are there any other ways to implement this and which might be the best option?
Thanks
Hemendra
↧
