Adding search time range to outputcsv


I have two searches appended together piped to a table_raw and dumped to an outputcsv and run this as a nightly report. The report is set to run at midnight and capture the previous 24hours of data. Is there a way to put the search time into the outputcsv file to use for auditing purposes?

Search example

index=index1 source=log1 "string of text" "string of text" | append [search index=index2 source=log2 Field=value] | table _raw | outputcsv filename.csv

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You can add the command at the end | addinfo | table _raw info_*

it will add to each event the field : info_max_time info_min_time info_search_time info_sid from time search details in epoch time.

example :

alt text

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!