Hi,
Splunk query the indexed iis data and generate the report on daily basis. Is it possible to append each and every data into spreadsheet? (automatically). Suppose I need 1 week data or 1 month data or 1 year data. I have already scheduled job on daily.
Please suggest me on this. What is the best approach.
Thanks,
Guru Prasad K
Hi Guru Prasad K
you can export results as CSV. just modify your search and schedule it to export the results.
if you have many lines in the csv. take a look at this link:
https://www.splunk.com/blog/2009/08/07/help-i-cant-export-more-than-10000-events/
Hi,
I understand your comment. Any way my scheduled job will send out report on every day basis. Based on my schedule job, can I append every day scheduled job data into one spreadsheet and from there I will upload that file into SharePoint.
Please any suggestion.
so, if i understand correctly, you want to add lines to the same csv every day?
Yes that's correct. every day data I wanted to add row by row in csv file. Is this possible or what is best approach for achieve this?
Please suggest
here is one approach. start your search with getting the last lookup (csv you created, lets say yesterday) | inputlookup <yourLookup.csv>
now write your search: | append [your search]
filter if needed | filter duplicates
lastly output to the same lookup from before. | outputlookup <yourLookup.csv>
that will have all results from last lookup and new events.
here is an answer that was posted in the past:
https://answers.splunk.com/answers/236903/how-to-update-a-lookup-table-using-a-scheduled-sea.html