topic Combine 3 csv reports and send it in one Email in Getting Data In

Combine 3 csv reports and send it in one Email

Shashank_87 — Wed, 04 Dec 2019 10:53:09 GMT

Hi, I am stuck into a weird problem. I have 3 queries from 3 different source producing a table with a service name and it's error count. Is it possible that I generate 3 reports, attach it in the same email and trigger it as a scheduled report. I know we can use append command but i think that will make the output a bit messy.
Is there any other way?

Re: Combine 3 csv reports and send it in one Email

woodcock — Wed, 04 Dec 2019 11:32:42 GMT

There are many ways but the best is like this:

|inputlookup append=t report1.csv
| eval which=coalesce(which, "report1.csv")
|inputlookup append=t report2.csv
| eval which=coalesce(which, "report2.csv")
|inputlookup append=t report3.csv
| eval which=coalesce(which, "report3.csv")

Re: Combine 3 csv reports and send it in one Email

Shashank_87 — Wed, 04 Dec 2019 11:56:41 GMT

@woodcock Hi, Thanks for your quick response. This really works fine. But I have to first output my query results to a CSV and then use the above command to append the results in one csv.

Actually what i was thinking of if we can create 3 separate csv's and attach them together in same mail. Not sure if that is possible?

Re: Combine 3 csv reports and send it in one Email

woodcock — Thu, 02 Jan 2020 02:29:20 GMT

You can also use loadjob and savedsearch to pull in the results of previous search runs; this will bypass having to write to a file but you run the risk of the searches' TTL expiring and splunk reaping the search job artifacts if you are not careful.