Splunk Search

Help with output csv by combining tokens from dashboard for the filename

robayers
Explorer

Here is a sample of the search, can anyone help?  The query works and returns data but errors out on the output filename creation.

 

| dbxquery query="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = '$field1$' AND TABLE_NAME = '$field2$';" connection="123456"
| table COLUMN_NAME| sort +COLUMN_NAME| outputcsv $field1$+$field2$.csv

 

Thanks in advance

Rob

Labels (3)
Tags (2)
0 Karma
1 Solution

bowesmana
Champion

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

View solution in original post

0 Karma

bowesmana
Champion

@robayers 

What's the error? Try quoting the tokens

| outputcsv "$field1$$field2$.csv"

 

0 Karma

robayers
Explorer

Adding the quotes didn't help. Here is the error,

Could not write to file `""$field$"-"$field2$"".csv"':  Failed to open file for writing.  It shows the red triangle with exclamation point.

 

The file gets created using the tokens in the filename, not the value of the tokens.  I've  specified " as a token prefix and suffix in the dropdown on the dashboard.

 

0 Karma

robayers
Explorer

I  didn't mean that I used them in  the field token name, see image  below. 

 

robayers_0-1606998143462.png

 

0 Karma

bowesmana
Champion

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

View solution in original post

0 Karma

robayers
Explorer

That's appears to have been the problem. I removed them from the dropdown configuration and verified that they  didn't exist in the search and it worked.

Thanks for your help.

Robert

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!