Adding search time range to outputcsv

[pete_charlton]

I have two searches appended together piped to a table_raw and dumped to an outputcsv and run this as a nightly report. The report is set to run at midnight and capture the previous 24hours of data. Is there a way to put the search time into the outputcsv file to use for auditing purposes?

Search example

index=index1 source=log1 "string of text" "string of text" | append [search index=index2 source=log2 Field=value] | table _raw | outputcsv filename.csv

[yannK]

You can add the command at the end | addinfo | table _raw info_*

it will add to each event the field : info_max_time info_min_time info_search_time info_sid from time search details in epoch time.

example :