Reporting

Is it possible to group several scheduled CSV reports into one email?

peterchow
Explorer

Dear all.

I have different kinds of scheduled CSV reports. I would like to group them into one email. May I know is it possible? Thanks

0 Karma

woodcock
Esteemed Legend

Yes, you can each search write its results out to separate KV Stores or disk files using outputlookup or outputcsv and then you can have a final separate search read them all in with a series of inputlookup or inputcsv commands chained together with append commands. Alternatively, you could skip the manual saving of the searches by ensuring that TTL is long enough and using a series of loadjob commands chained together with append commands.

0 Karma

peterchow
Explorer

Sorry, I don understand. Can you explain about that? Is it possible to have an example? Thanks

0 Karma

woodcock
Esteemed Legend

Let us say that we have 3 different reports that run every night. Add one line to the end of each report:

... | outputcsv ReportNumberOne.csv
... | outputcsv ReportNumberTwo.csv
... | outputcsv ReportNumberThree.csv

Then join them together in a new report like this:

|inputcsv ReportNumberOne.csv]
| appendpipe [|inputcsv ReportNumberTwo.csv]
| appendpipe [|inputcsv ReportNumberThree.csv]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...