• About Splunk
  • About Splunk
• Tutorial
  • Introduction to Splunk
    • Requirements
    • Log in
    • Index data
    • Simple searches
    • Click on results
    • Scroll through results
    • Narrow results
    • Follow a relationship
    • Chang the time range
    • Boolean searches
    • Save a search
  • Navigating search results
    • Filter on host, source, and sourcetype (search fields)
    • Showing more fields
    • Filter on extracted fields
    • Taking snapshots
    • Customize SplunkWeb
  • Event types and punct::
    • What are event types?
    • What is punct::?
    • Find similar events with punct::
    • Saving event types
    • View and search for event types
    • Automated event type discovery
    • Tagging
  • Alerting
    • Save a search
    • Schedule it
    • Set alerting conditions
    • Set the alerting method
    • Permalink your saved search
    • Manage your saved searches and alerts
  • Reporting
    • Report on a field
    • Build a new report
    • Pick a different chart
    • Add it to your dashboard
  • Using search commands
    • timechart
    • stats
    • top
    • rare
    • where
    • fields
    • sort
    • Subsearches
    • diff
    • set
    • regex
  • Command line interface (CLI)
    • Examples
    • Built-in help
    • Basic commands
  • Sharing
    • Creating, tagging, and sharing eventtypes
    • Saved searches
    • SplunkBase
• Reference
  • Search syntax overview
    • Syntax definition
    • Syntax for subsearches
    • Tuning search performance
  • Search
    • Keywords
    • Wildcards *
    • Searching for "*"
    • "Quotation marks"
    • Punctuation marks
    • Booleans
    • Fields
    • Modifiers
    • Subsearches
  • Search modifiers
    • Conventions used in this reference
    • daysago
    • enddaysago
    • endhoursago
    • endminutesago
    • endmonthsago
    • endtime
    • hosttag
    • hoursago
    • index
    • maxresults
    • minutesago
    • monthsago
    • readlevel
    • readlimit
    • related
    • savedsearch
    • searchtimespanminutes
    • searchtimespanhours
    • searchtimespandays
    • searchtimespanmonths
    • startminutesago
    • starthoursago
    • startdaysago
    • startmonthsago
    • timeformat
  • Core search fields
    • host
    • source
    • sourcetype
  • Search fields
    • _raw
    • _serial
    • _time
    • date_hour
    • date_minute
    • date_month
    • date_mday
    • date_second
    • date_wday
    • date_year
    • date_zone
    • eventtype
    • eventtypetag
    • endtime
    • endtimeu
    • linecount
    • punct
    • starttime
    • starttimeu
    • timestamp::none
    • user
• Search command reference
  • Search commands
    • Conventions used in the search reference
    • The run command
    • The admin command
  • Data-generating commands
    • file
    • remote
    • savedsearch
    • search
  • Saving commands
    • outputcsv
    • outputraw
    • outputtext
    • outputxml
    • sendemail
  • Filtering and re-ordering commands
    • page
    • regex
    • set
    • sort
    • uniq
    • where
  • Transforming and reporting commands
    • associate
    • chart
    • contingency
    • correlate
    • diff
    • format
    • rare
    • select
    • stats
    • timechart
    • top
    • xmlunescape
  • Evaluating commands
    • abstract
    • addtotals
    • anomalousvalue
    • bucket
    • convert
    • eval
    • fields
    • fillnull
    • kmeans
    • outlier
    • rename
    • replace
  • Extracting commands
    • extract
    • multikv
    • xmlkv

Saving commands

outputcsv

This data-processing command is used to output search results in CSV format. This command is useful for formatting result output while using the CLI. If no target filename is specified as an argument, outputcsv rewrites the contents of each search result into a CSV-formatted row in the field "_xml". If a filename is specified, outputcsv writes the CSV-formatted results into the specified file (and appends .csv to the filename if there is no existing extension). If the output spans multiple files, outputcsv can collapse the output to a single file. outputcsv should be the last command specified in a search.

Syntax

outputcsv [usexml_option] [filename] [singlefile_option]

Arguments

Examples

./splunk search "secrets source="tcpdump" |  outputcsv"

• Searches for the word secrets from the source tcpdump, and outputs the data in csv format.

outputraw

This data-processing command causes search results to be output in a simple, raw text format. outputraw should be the last command specified in a search.

Syntax

outputraw

Arguments

None.

Examples

./splunk search "secrets source="tcpdump" |  outputraw"

• Searches for the word secrets from the source tcpdump, and outputs the data in raw text format.

outputtext

This data-processing command causes the contents of the _raw field of a result to be written into the " _xml" field. Optionally, you can set outputtext to parse XML escaping characters. outputtext should be the last command specified in a search.

Syntax

outputtext [usexml]

Arguments

Examples

./splunk search "404 source="webserver" | sort +ip, url | top 5 | outputtext

• Searches for "404" on webserver, and sorts the results first by fields ip and url then filters the top 5 results. It will then output the top 5 results in a raw text format.

outputxml

This data-processing command causes search results to be written to a proprietary and internal XML format. outputxml should be the last command specified in a search.

Syntax

outputxml [string]

Arguments

Examples

./splunk search "404 source="webserver" | sort +ip, url | top 5 | outputxml 404s.xml

• Searches for "404" on webserver, and sorts the results first by fields ip and url then filters the top 5 results. It will then output the top 5 results in a xml format to 404s.xml.

sendemail

This data-processing command will email your search results to the email address you specify. You may specify multiple email addresses to send your results to, and you can select the format to send the results in (html, raw, text, csv). You may also choose to send the results in the body of the email, or as an attachment. You must use quotes when specifying an email list.

Syntax

sendemail to="email_list" [email-options]...

Arguments

email-options

email-options=	from | cc | bcc | format | inline | priority | server	Additional email options you can specify.
from=	from="email_list"(splunk@hostname)	Specify an email address for the from line. Default = splunk@hostname.
cc=	cc="email_list"	A comma-separated list of valid email addresses to put in the carbon copy (cc) field.
bcc=	bcc="email_list"	A comma-separated list of valid email addresses to put in the blind carbon copy (bcc) field.
format=	format=(html | raw | text | csv)(html)	Specify the format of the email that the results are sent in.
inline=	inline=(T | F) (T)	Set whether to have the results sent in the body of the email, or as an attachment. Setting to true sends them in the body of the email.
priority=	priority=(1 | 2 | 3 | 4 | 5) (3)	Set the email's priority. 3 = normal, 1 = highest, 2 = high, 4 = low, 5 = lowest.
server=	server=name of server(localhost)	Set the smtp server. Default is localhost.

Examples

SplunkWeb:

fail sourcetype="access*" | rename _raw as marklar | stats dc(marklar) by _time | sendemail from=cartman@sp.com format=html subject=failboat server=mail.sp.com

• Searches for "fail" on all sourcetypes that start with "access". Then renames the _raw field as marklar, does a stats operation to find the distinct count, and sends the results to cartman@sp.com in an html-formatted email with the subject "failboat".