Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- use source name as outputcsv filename
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]
This example will give you the source file name plus add the current timestamp to the end of the filename
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your comment!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]
This example will give you the source file name plus add the current timestamp to the end of the filename
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, cramasta!
This is exactly what I need!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Having dynamic output filenames is possible. I use it to output files with the date. Post an example search since the technique varies. The all use sub searches with "return" though.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
