Alerting
Highlighted

How to append results of an alert to output file instead of overriding each time alerts is triggered?

New Member

I am trying to modify an alert which will provide server logon details with specific username each time login is successful.
I have scheduled alert for every 1hr. But each time alert is triggered results getting overwritten.

Can someone suggest how to append the results to output file instead of overriding?

0 Karma
Highlighted

Re: How to append results of an alert to output file instead of overriding each time alerts is triggered?

SplunkTrust
SplunkTrust

Could you provide the search as it is now, the time frame it runs over and what it actually does?

I'm also not quite sure I understand the use case here. Are you using the alert to email someone with an attached CSV or are you writing an output file as CSV with this information (a la outputlookup or exportcsv)? Do you have a sample of this?

Any how do you want to include old alert results? Like, do you want the once-per-hour alert to include the last day's worth of information?

Or is all this to create something like a summary of activity on that/those servers?

0 Karma
Highlighted

Re: How to append results of an alert to output file instead of overriding each time alerts is triggered?

SplunkTrust
SplunkTrust
| outputcsv append=t mycsv.csv

or

| outputlookup append=t mycsv.csv