Splunk Search

Help with output csv by combining tokens from dashboard for the filename

robayers
Explorer

Here is a sample of the search, can anyone help?  The query works and returns data but errors out on the output filename creation.

 

| dbxquery query="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = '$field1$' AND TABLE_NAME = '$field2$';" connection="123456"
| table COLUMN_NAME| sort +COLUMN_NAME| outputcsv $field1$+$field2$.csv

 

Thanks in advance

Rob

Labels (3)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@robayers 

What's the error? Try quoting the tokens

| outputcsv "$field1$$field2$.csv"

 

0 Karma

robayers
Explorer

Adding the quotes didn't help. Here is the error,

Could not write to file `""$field$"-"$field2$"".csv"':  Failed to open file for writing.  It shows the red triangle with exclamation point.

 

The file gets created using the tokens in the filename, not the value of the tokens.  I've  specified " as a token prefix and suffix in the dropdown on the dashboard.

 

0 Karma

robayers
Explorer

I  didn't mean that I used them in  the field token name, see image  below. 

 

robayers_0-1606998143462.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

0 Karma

robayers
Explorer

That's appears to have been the problem. I removed them from the dropdown configuration and verified that they  didn't exist in the search and it worked.

Thanks for your help.

Robert

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...