Alerting

How to append results of an alert to output file instead of overriding each time alerts is triggered?

vijayameda
New Member

I am trying to modify an alert which will provide server logon details with specific username each time login is successful.
I have scheduled alert for every 1hr. But each time alert is triggered results getting overwritten.

Can someone suggest how to append the results to output file instead of overriding?

0 Karma

DalJeanis
Legend
| outputcsv append=t mycsv.csv

or

| outputlookup append=t mycsv.csv

Richfez
SplunkTrust
SplunkTrust

Could you provide the search as it is now, the time frame it runs over and what it actually does?

I'm also not quite sure I understand the use case here. Are you using the alert to email someone with an attached CSV or are you writing an output file as CSV with this information (a la outputlookup or exportcsv)? Do you have a sample of this?

Any how do you want to include old alert results? Like, do you want the once-per-hour alert to include the last day's worth of information?

Or is all this to create something like a summary of activity on that/those servers?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...