Reporting

How to set a dynamic time parameter to scheduled saved search?

newbie2tech
Communicator

Hi Team,

I have a scheduled saved search which generates the csv file on the splunk server. Everyday it runs at 7 am and gets the data for previous day[yesterday] as a csv file.

Now i have a requirement where the team wants to generate csv files, 1 file per day for 3 months worth of data from last year[ say jan- apr].

My question is how can i generate csv file 1 per day [ jan 1, jan2 , jan3 ...mar 31] for this historical data using saved searches, how to pass different earliest and latest times for each runs.

Can you please suggest some solutions other than using python/sdk.

Thanks!

Splunk 6.5.1

0 Karma

valiquet
Contributor

|your saved search | stats min(time), max(time) | outputlookup append=t year.csv

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...