take SID in an alert

[gcusello]

Hi at all,
I need to use SID as filename in an outputcsv command.
I reached to do this in a normal search

my_search
| ...
| addinfo
| outputcsv [ search * | head 1 | addinfo | eval query="my_alert_".info_sid | fields query | format "" "" "" "" "" "" ] singlefile=1

and I have a file called "my_search_1234567890.12345.csv".

The problem is when I schedule this search in an alert because the output csv is "my_search_schedule_admin.csv", in other words: running an alerts, instead SID I have the fixed string "schedule_admin".

Anyone has an idea where to search solution or (best) has a solution to solve the problem?

Thank you in advance.

Bye.
Giuseppe

[harsmarvania57]

Just FYI, if you are using search head pooling or search head clustering then outputcsv is not compatible, see reference doc http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Outputcsv#Distributed_deployments

[gcusello]

None of them: it's a single Search Head!
Anyway, my search correctly runs in search mode, there's this strange behavior only running as alert.
Thanks.
Bye.
Giuseppe

[gcusello]

One additional information: I found that this problem there's only on a Windows machine, on a Linux machine I have the correct SID.
Bye.
Giuseppe