Reporting

use source name as outputcsv filename

Communicator

Hello!
It is possible? If yes, how this can be done?

Tags (2)
0 Karma
1 Solution

Builder

This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths

index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]

This example will give you the source file name plus add the current timestamp to the end of the filename

index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]

View solution in original post

Communicator

Thank you for your comment!

0 Karma

Builder

This will output a csv using the source of the data set you are searching against. It should work for both linux and window file paths

index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | fields search]

This example will give you the source file name plus add the current timestamp to the end of the filename

index=foo sourcetype=bar | outputcsv [ index=foo sourcetype=bar | head 1| eval search = replace(source, ".*/|.*\\\|\.\w+", "") | eval search=strftime(now(), search."_%Y%m%d%H%M%S") | fields search]

View solution in original post

Communicator

Thank you, cramasta!
This is exactly what I need!

0 Karma

Influencer

Having dynamic output filenames is possible. I use it to output files with the date. Post an example search since the technique varies. The all use sub searches with "return" though.

0 Karma