This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]
This example will give you the source file name plus add the current timestamp to the end of the filename
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]
Thank you for your comment!
This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]
This example will give you the source file name plus add the current timestamp to the end of the filename
index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]
Thank you, cramasta!
This is exactly what I need!
Having dynamic output filenames is possible. I use it to output files with the date. Post an example search since the technique varies. The all use sub searches with "return" though.