Getting Data In

outputcsv: How to include the current Splunk user ID and date in the CSV file name? (ex: splunkuserid_date.csv)

remnant_8
Explorer

I want output csv like this "splunkuserid_data.csv" automatically. For example:
admin_17_05_16_09_07_58.csv
I tried this search:

my search | outputcsv [| stats count | addinfo | eval filename=strftime(now(), "filename_%d_%m_%y_%H_%M_%S") | return $filename ] 

I know how to get get the current Splunk user id with |rest /services/authentication/current-context splunk_server=local | fields username, but I don't know how to include the Splunk user id in the CSV file name

Does anyone have an idea?

1 Solution

remnant_8
Explorer

I used SPL like this 🙂

my search | outputcsv  [ | rest /services/authentication/current-context splunk_server=local | eval time=strftime(now(), "%Y_%m_%d_%H_%M_%S") | fields username time | eval csvnm = toString(username) + "_" +toString(time) | return $csvnm] 

View solution in original post

remnant_8
Explorer

I used SPL like this 🙂

my search | outputcsv  [ | rest /services/authentication/current-context splunk_server=local | eval time=strftime(now(), "%Y_%m_%d_%H_%M_%S") | fields username time | eval csvnm = toString(username) + "_" +toString(time) | return $csvnm] 
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...