topic How to create dump command and put datetime? in Getting Data In

How to create dump command and put datetime?

khyoung7410 — Tue, 03 Apr 2018 15:26:33 GMT

Ask about basefilename in dump command.
I would like to create a file by date with search results and I would like to put the time in basefilename as in the month and date.
What should I do?

My Search is:

 index=_audit 
    | eval date=strftime(_time,"%F %T") 
    | eval _dstpath=strftime(_time, "%Y%m/%d") 
    | dump basefilename=splunk format=csv fields="date, user, action, info, index, sourcetype"

Re: How to create dump command and put datetime?

s2_splunk — Tue, 03 Apr 2018 17:38:58 GMT

The only thing I can think of is to create a macro, since the dump command does not accept variables directly.

Example:

You can then do something like this:

<yoursearch> | eval myFileName="DumpFile_".strftime(now(),"%Y%m%d") | `dumpWithFilename(myFileName)`

Adjust your macro to include other parameters as needed.