How to append results of an alert to output file instead of overriding each time alerts is triggered?

[vijayameda]

I am trying to modify an alert which will provide server logon details with specific username each time login is successful.
I have scheduled alert for every 1hr. But each time alert is triggered results getting overwritten.

Can someone suggest how to append the results to output file instead of overriding?

[Richfez]

Could you provide the search as it is now, the time frame it runs over and what it actually does?

I'm also not quite sure I understand the use case here. Are you using the alert to email someone with an attached CSV or are you writing an output file as CSV with this information (a la outputlookup or exportcsv)? Do you have a sample of this?

Any how do you want to include old alert results? Like, do you want the once-per-hour alert to include the last day's worth of information?

Or is all this to create something like a summary of activity on that/those servers?

[DalJeanis]

| outputcsv append=t mycsv.csv

or

| outputlookup append=t mycsv.csv