topic Re: Store everyday data into spreadsheet (Append data on date wise) in Deployment Architecture

Store everyday data into spreadsheet (Append data on date wise)

guruwells — Tue, 28 Mar 2017 12:45:54 GMT

Hi,
Splunk query the indexed iis data and generate the report on daily basis. Is it possible to append each and every data into spreadsheet? (automatically). Suppose I need 1 week data or 1 month data or 1 year data. I have already scheduled job on daily.

Please suggest me on this. What is the best approach.

Thanks,
Guru Prasad K

Re: Store everyday data into spreadsheet (Append data on date wise)

adonio — Tue, 28 Mar 2017 13:07:55 GMT

Hi Guru Prasad K
you can export results as CSV. just modify your search and schedule it to export the results.
if you have many lines in the csv. take a look at this link:
https://www.splunk.com/blog/2009/08/07/help-i-cant-export-more-than-10000-events/

Re: Store everyday data into spreadsheet (Append data on date wise)

guruwells — Tue, 28 Mar 2017 13:15:01 GMT

Hi,
I understand your comment. Any way my scheduled job will send out report on every day basis. Based on my schedule job, can I append every day scheduled job data into one spreadsheet and from there I will upload that file into SharePoint.

Please any suggestion.

Re: Store everyday data into spreadsheet (Append data on date wise)

adonio — Tue, 28 Mar 2017 13:21:03 GMT

so, if i understand correctly, you want to add lines to the same csv every day?

Re: Store everyday data into spreadsheet (Append data on date wise)

guruwells — Tue, 28 Mar 2017 13:24:10 GMT

Yes that's correct. every day data I wanted to add row by row in csv file. Is this possible or what is best approach for achieve this?

Please suggest

Re: Store everyday data into spreadsheet (Append data on date wise)

adonio — Tue, 28 Mar 2017 13:35:09 GMT

here is one approach. start your search with getting the last lookup (csv you created, lets say yesterday) | inputlookup <yourLookup.csv>
now write your search: | append [your search] filter if needed | filter duplicates
lastly output to the same lookup from before. | outputlookup <yourLookup.csv>
that will have all results from last lookup and new events.
here is an answer that was posted in the past:
https://answers.splunk.com/answers/236903/how-to-update-a-lookup-table-using-a-scheduled-sea.html