How to create dump command and put datetime?

[khyoung7410]

Hi

Ask about basefilename in dump command.
I would like to create a file by date with search results and I would like to put the time in basefilename as in the month and date.
What should I do?

My Search is:

 index=_audit 
    | eval date=strftime(_time,"%F %T") 
    | eval _dstpath=strftime(_time, "%Y%m/%d") 
    | dump basefilename=splunk format=csv fields="date, user, action, info, index, sourcetype" 

[ssievert_splunk]

The only thing I can think of is to create a macro, since the dump command does not accept variables directly.

Example:

You can then do something like this:

<yoursearch> | eval myFileName="DumpFile_".strftime(now(),"%Y%m%d") | `dumpWithFilename(myFileName)`

Adjust your macro to include other parameters as needed.