how to export entityid in csv file
I know the command is outputcsv
what is full command to extract value for specific field like entityid
Like this:
... | table entityid | outputlookup YourOutputFileNameHere.csv
View solution in original post
I think you might want outputlookup https://answers.splunk.com/answers/275602/difference-between-outputlookup-and-outputcsv.html, but the syntax is pretty straightforward - you take the results of your search and then append an
outputlookup
|outputlookup csvName.csv command. If you only want to extract something like entityid, you can use a table command before hand to only have that field be sent over.
|outputlookup csvName.csv
table
Does this answer your question?
