Dear all.
I have different kinds of scheduled CSV reports. I would like to group them into one email. May I know is it possible? Thanks
Yes, you can each search write its results out to separate KV Stores
or disk files using outputlookup
or outputcsv
and then you can have a final separate search read them all in with a series of inputlookup
or inputcsv
commands chained together with append
commands. Alternatively, you could skip the manual saving of the searches by ensuring that TTL
is long enough and using a series of loadjob
commands chained together with append
commands.
Sorry, I don understand. Can you explain about that? Is it possible to have an example? Thanks
Let us say that we have 3 different reports that run every night. Add one line to the end of each report:
... | outputcsv ReportNumberOne.csv
... | outputcsv ReportNumberTwo.csv
... | outputcsv ReportNumberThree.csv
Then join them together in a new report like this:
|inputcsv ReportNumberOne.csv]
| appendpipe [|inputcsv ReportNumberTwo.csv]
| appendpipe [|inputcsv ReportNumberThree.csv]