https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-scheduled-report-for-CSV-export/m-p/410471#M72723 <P>Hi All! <BR /> I have following query, I want to schedule a report for this for every night. <BR /> When I export this to CSV after searching the fields get all mixed up. <BR /> Any idea on how to rewrite this to get similar results but would work well in CSV?</P> <PRE><CODE>index=rapid7 nexpose_severity=Severe OR nexpose_severity=Critical "tag::eventtype"=vulnerability site_id=64 OR site_id=55 OR site_id=63 OR site_id=62 | eval site_info=case(site_id==63,"Public IPs: Corp IT 2", site_id==64 ,"Public IPs:3", site_id==62,"Public IPs: Corp 4",site_id==23,"Corp - Office - 1",site_id==60,"Rapid7 Insight Agents", site_id=55,"Public IPs: 5")| stats values(signature) AS "Vulnerabilities", values(cve) AS "CVE", values(nexpose_severity) AS "Severity", values(site_info) AS "Site ID", values(date_added) AS "DATE_ADDED" distinct_count(cve) AS distinct_count_vulnerabilities by ip | sort -distinct_count_vulnerabilities </CODE></PRE> <P>Thanks in advance for your help !</P> Fri, 07 Jun 2019 18:18:53 GMT dmenon 2019-06-07T18:18:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-scheduled-report-for-CSV-export/m-p/410471#M72723 <P>Hi All! <BR /> I have following query, I want to schedule a report for this for every night. <BR /> When I export this to CSV after searching the fields get all mixed up. <BR /> Any idea on how to rewrite this to get similar results but would work well in CSV?</P> <PRE><CODE>index=rapid7 nexpose_severity=Severe OR nexpose_severity=Critical "tag::eventtype"=vulnerability site_id=64 OR site_id=55 OR site_id=63 OR site_id=62 | eval site_info=case(site_id==63,"Public IPs: Corp IT 2", site_id==64 ,"Public IPs:3", site_id==62,"Public IPs: Corp 4",site_id==23,"Corp - Office - 1",site_id==60,"Rapid7 Insight Agents", site_id=55,"Public IPs: 5")| stats values(signature) AS "Vulnerabilities", values(cve) AS "CVE", values(nexpose_severity) AS "Severity", values(site_info) AS "Site ID", values(date_added) AS "DATE_ADDED" distinct_count(cve) AS distinct_count_vulnerabilities by ip | sort -distinct_count_vulnerabilities </CODE></PRE> <P>Thanks in advance for your help !</P> Fri, 07 Jun 2019 18:18:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-scheduled-report-for-CSV-export/m-p/410471#M72723 dmenon 2019-06-07T18:18:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-scheduled-report-for-CSV-export/m-p/410472#M72724 <P>You could create a lookup file that you then schedule your search and have it appended with:</P> <P>| table field1 field2 field3 etc | outputlookup </P> <P>That way your search results would be written to the csv behind the lookup at every run.</P> <P>If it's a formatting issue, can you explain more about what you mean when you say "The fields get all mixed up"?</P> Fri, 07 Jun 2019 19:56:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-scheduled-report-for-CSV-export/m-p/410472#M72724 martynoconnor 2019-06-07T19:56:12Z