Getting Data In

How to create dump command and put datetime?

khyoung7410
Communicator

Hi

Ask about basefilename in dump command.
I would like to create a file by date with search results and I would like to put the time in basefilename as in the month and date.
What should I do?

My Search is:

 index=_audit 
    | eval date=strftime(_time,"%F %T") 
    | eval _dstpath=strftime(_time, "%Y%m/%d") 
    | dump basefilename=splunk format=csv fields="date, user, action, info, index, sourcetype" 
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The only thing I can think of is to create a macro, since the dump command does not accept variables directly.

Example:
alt text

You can then do something like this:

<yoursearch> | eval myFileName="DumpFile_".strftime(now(),"%Y%m%d") | `dumpWithFilename(myFileName)`

Adjust your macro to include other parameters as needed.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...