https://community.splunk.com/t5/Reporting/Adding-search-time-range-to-outputcsv/m-p/122827#M2763 <P>You can add the command at the end <CODE>| addinfo | table _raw info_*</CODE></P> <P>it will add to each event the field : info_max_time info_min_time info_search_time info_sid from time search details in epoch time. </P> <P>example :</P> <P><IMG src="http://answers.splunk.com//storage/Screen_Shot_2014-09-12_at_11.55.48_AM.png" alt="alt text" /></P> Mon, 28 Sep 2020 17:34:19 GMT yannK 2020-09-28T17:34:19Z https://community.splunk.com/t5/Reporting/Adding-search-time-range-to-outputcsv/m-p/122826#M2762 <P>I have two searches appended together piped to a table_raw and dumped to an outputcsv and run this as a nightly report. The report is set to run at midnight and capture the previous 24hours of data. Is there a way to put the search time into the outputcsv file to use for auditing purposes?</P> <P>Search example</P> <P>index=index1 source=log1 "string of text" "string of text" | append [search index=index2 source=log2 Field=value] | table _raw | outputcsv filename.csv</P> Fri, 12 Sep 2014 17:05:30 GMT https://community.splunk.com/t5/Reporting/Adding-search-time-range-to-outputcsv/m-p/122826#M2762 pete_charlton 2014-09-12T17:05:30Z https://community.splunk.com/t5/Reporting/Adding-search-time-range-to-outputcsv/m-p/122827#M2763 <P>You can add the command at the end <CODE>| addinfo | table _raw info_*</CODE></P> <P>it will add to each event the field : info_max_time info_min_time info_search_time info_sid from time search details in epoch time. </P> <P>example :</P> <P><IMG src="http://answers.splunk.com//storage/Screen_Shot_2014-09-12_at_11.55.48_AM.png" alt="alt text" /></P> Mon, 28 Sep 2020 17:34:19 GMT https://community.splunk.com/t5/Reporting/Adding-search-time-range-to-outputcsv/m-p/122827#M2763 yannK 2020-09-28T17:34:19Z