topic Re: outputcsv - append field value in filename in Getting Data In

outputcsv - append field value in filename

vb1612 — Sun, 26 May 2019 01:25:56 GMT

I have field name xyz , want to append value of this field in outputcsv filename

Re: outputcsv - append field value in filename

DavidHourani — Sun, 26 May 2019 07:24:16 GMT

Hi @vb1612,

Where is your field located ? Is it in an index ? Are you trying to combine fields from multiple sources ?

Official documentation for output CSV is in Splunk docs :
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Outputcsv

So all you have to do is make sure your field is there before you run the outputcsv command:

index=yourindex sourcetype=yoursourcetype | fields fields_you_want_to_keep | outputcsv MyTestCsvFile

Pease provide some sample data if you want you help with your specific SPL.

Cheers,
David

Re: outputcsv - append field value in filename

koshyk — Sun, 26 May 2019 08:50:44 GMT

Something like this..

<your_search_to_get_xyz field>
|eval myCSVFile=xyz
| map search="search index=_internal| fields host,sourcetype,source|outputlookup $myCSVFile$.csv"

Above is an example.. Change it to your own searches to generate the xyz field and then apply it to the output of another search to generate outputlookup