Splunk Search

Help with output csv by combining tokens from dashboard for the filename

robayers
Explorer

Here is a sample of the search, can anyone help?  The query works and returns data but errors out on the output filename creation.

 

| dbxquery query="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = '$field1$' AND TABLE_NAME = '$field2$';" connection="123456"
| table COLUMN_NAME| sort +COLUMN_NAME| outputcsv $field1$+$field2$.csv

 

Thanks in advance

Rob

Labels (2)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@robayers 

What's the error? Try quoting the tokens

| outputcsv "$field1$$field2$.csv"

 

0 Karma

robayers
Explorer

Adding the quotes didn't help. Here is the error,

Could not write to file `""$field$"-"$field2$"".csv"':  Failed to open file for writing.  It shows the red triangle with exclamation point.

 

The file gets created using the tokens in the filename, not the value of the tokens.  I've  specified " as a token prefix and suffix in the dropdown on the dashboard.

 

0 Karma

robayers
Explorer

I  didn't mean that I used them in  the field token name, see image  below. 

 

robayers_0-1606998143462.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

0 Karma

robayers
Explorer

That's appears to have been the problem. I removed them from the dropdown configuration and verified that they  didn't exist in the search and it worked.

Thanks for your help.

Robert

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...