topic Re: 'Empty' a csv on a daily basis in Splunk Search

'Empty' a csv on a daily basis

timrich66 — Wed, 08 Jul 2020 11:23:47 GMT

Hi all,

I have a dashboard where users can add comments to a .csv lookup file. The comments are only related to the day that they are added. I would like to be able to clear down the .csv on a daily basis (around midnight). Is there a way that I can do this using Splunk to keep all the code in one place?

I plan to use the 'collect' command to send the contents to an index prior to removing all the entries in whatever way is possible.

I have tried using outputlookup but only succeeded in writing blank lines to the .csv, not overwriting or removing the contents.

Thanks

Re: 'Empty' a csv on a daily basis

skalliger — Wed, 08 Jul 2020 13:19:31 GMT

Have you tried using the paramter

create_empty=true

in your outputlookup command?

Skalli

Re: 'Empty' a csv on a daily basis

timrich66 — Wed, 08 Jul 2020 13:33:03 GMT

Hi @skalliger , thanks for the reply. Yes, I tried this but only managed to create empty lines in the csv.

I have written this search which only returns the entries for 'today'. A work around for now.