Ask about basefilename in dump command.
I would like to create a file by date with search results and I would like to put the time in basefilename as in the month and date.
What should I do?
My Search is:
| eval date=strftime(_time,"%F %T")
| eval _dstpath=strftime(_time, "%Y%m/%d")
| dump basefilename=splunk format=csv fields="date, user, action, info, index, sourcetype"
The only thing I can think of is to create a macro, since the dump command does not accept variables directly.
You can then do something like this:
<yoursearch> | eval myFileName="DumpFile_".strftime(now(),"%Y%m%d") | `dumpWithFilename(myFileName)`
Adjust your macro to include other parameters as needed.