Deployment Architecture

Store everyday data into spreadsheet (Append data on date wise)

guruwells
Explorer

Hi,
Splunk query the indexed iis data and generate the report on daily basis. Is it possible to append each and every data into spreadsheet? (automatically). Suppose I need 1 week data or 1 month data or 1 year data. I have already scheduled job on daily.

Please suggest me on this. What is the best approach.

Thanks,
Guru Prasad K

Tags (1)
0 Karma

adonio
Ultra Champion

Hi Guru Prasad K
you can export results as CSV. just modify your search and schedule it to export the results.
if you have many lines in the csv. take a look at this link:
https://www.splunk.com/blog/2009/08/07/help-i-cant-export-more-than-10000-events/

0 Karma

guruwells
Explorer

Hi,
I understand your comment. Any way my scheduled job will send out report on every day basis. Based on my schedule job, can I append every day scheduled job data into one spreadsheet and from there I will upload that file into SharePoint.

Please any suggestion.

0 Karma

adonio
Ultra Champion

so, if i understand correctly, you want to add lines to the same csv every day?

0 Karma

guruwells
Explorer

Yes that's correct. every day data I wanted to add row by row in csv file. Is this possible or what is best approach for achieve this?

Please suggest

0 Karma

adonio
Ultra Champion

here is one approach. start your search with getting the last lookup (csv you created, lets say yesterday) | inputlookup <yourLookup.csv>
now write your search: | append [your search] filter if needed | filter duplicates
lastly output to the same lookup from before. | outputlookup <yourLookup.csv>
that will have all results from last lookup and new events.
here is an answer that was posted in the past:
https://answers.splunk.com/answers/236903/how-to-update-a-lookup-table-using-a-scheduled-sea.html

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...