use source name as outputcsv filename

[ryastrebov]

Hello!
It is possible? If yes, how this can be done?

[ryastrebov]

Thank you for your comment!

[cramasta · Accepted solution]

This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths

index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]

This example will give you the source file name plus add the current timestamp to the end of the filename

index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]

[ryastrebov]

Thank you, cramasta!
This is exactly what I need!

[jonuwz]

Having dynamic output filenames is possible. I use it to output files with the date. Post an example search since the technique varies. The all use sub searches with "return" though.