Hi Team,
I have a scheduled saved search which generates the csv file on the splunk server. Everyday it runs at 7 am and gets the data for previous day[yesterday] as a csv file.
Now i have a requirement where the team wants to generate csv files, 1 file per day for 3 months worth of data from last year[ say jan- apr].
My question is how can i generate csv file 1 per day [ jan 1, jan2 , jan3 ...mar 31] for this historical data using saved searches, how to pass different earliest and latest times for each runs.
Can you please suggest some solutions other than using python/sdk.
Thanks!
Splunk 6.5.1
|your saved search | stats min(time), max(time) | outputlookup append=t year.csv