Alerting

Alert when triggered - Output results to lookup with dynamic filename

Explorer

hi!

I have an alert, which when triggered it saves "Output results to lookup" csv file. Is there a way to have a dynamic filename where the data is saved? I.e. instead of one name results.csv I would like to add date in the end: results_2020_08_03.csv or something like this. 

Haven't found anything in the documentation about it.

thanks in advance,

przemek

Labels (1)
Tags (1)
0 Karma
1 Solution

Champion

Hi

at least this works with 8.0.5.

 

index=_internal 
| head 1 
| outputlookup
    [| makeresults 
    | eval query="results_".strftime(now(),"%d_%m_%y_%H_%M_%S").".csv" 
    | fields query 
    | format "" "" "" "" "" ""]

 

You cannot use outputcsv e.g. in SHC as it don't replicate that lookuptable as outputlookup will do.

r. Ismo 

View solution in original post

Champion
0 Karma

Explorer

Hi,

Thanks for the fast reply, but this solution is not gonna work for me. It places csv file to $SPLUNK_HOME/var/run/splunk/csv on a local searchhead. This is an alert and a file for customer who does not have access to Splunk infrastructure. 

Any other ideas?

BR,

Przemek

0 Karma

Champion

Hi

at least this works with 8.0.5.

 

index=_internal 
| head 1 
| outputlookup
    [| makeresults 
    | eval query="results_".strftime(now(),"%d_%m_%y_%H_%M_%S").".csv" 
    | fields query 
    | format "" "" "" "" "" ""]

 

You cannot use outputcsv e.g. in SHC as it don't replicate that lookuptable as outputlookup will do.

r. Ismo 

View solution in original post

Explorer

This is basically what I needed - thank you

0 Karma