how to export entityid in csv file
I know the command is outputcsv
what is full command to extract value for specific field like entityid
Like this:
... | table entityid
| outputlookup YourOutputFileNameHere.csv
Like this:
... | table entityid
| outputlookup YourOutputFileNameHere.csv
I think you might want outputlookup
https://answers.splunk.com/answers/275602/difference-between-outputlookup-and-outputcsv.html, but the syntax is pretty straightforward - you take the results of your search and then append an
|outputlookup csvName.csv
command. If you only want to extract something like entityid, you can use a table
command before hand to only have that field be sent over.
Does this answer your question?