Getting Data In

outputcsv: How to include the current Splunk user ID and date in the CSV file name? (ex: splunkuserid_date.csv)

remnant_8
Explorer

I want output csv like this "splunkuserid_data.csv" automatically. For example:
admin_17_05_16_09_07_58.csv
I tried this search:

my search | outputcsv [| stats count | addinfo | eval filename=strftime(now(), "filename_%d_%m_%y_%H_%M_%S") | return $filename ] 

I know how to get get the current Splunk user id with |rest /services/authentication/current-context splunk_server=local | fields username, but I don't know how to include the Splunk user id in the CSV file name

Does anyone have an idea?

1 Solution

remnant_8
Explorer

I used SPL like this 🙂

my search | outputcsv  [ | rest /services/authentication/current-context splunk_server=local | eval time=strftime(now(), "%Y_%m_%d_%H_%M_%S") | fields username time | eval csvnm = toString(username) + "_" +toString(time) | return $csvnm] 

View solution in original post

remnant_8
Explorer

I used SPL like this 🙂

my search | outputcsv  [ | rest /services/authentication/current-context splunk_server=local | eval time=strftime(now(), "%Y_%m_%d_%H_%M_%S") | fields username time | eval csvnm = toString(username) + "_" +toString(time) | return $csvnm] 
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...