Splunk Search

Help with output csv by combining tokens from dashboard for the filename

robayers
Explorer

Here is a sample of the search, can anyone help?  The query works and returns data but errors out on the output filename creation.

 

| dbxquery query="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = '$field1$' AND TABLE_NAME = '$field2$';" connection="123456"
| table COLUMN_NAME| sort +COLUMN_NAME| outputcsv $field1$+$field2$.csv

 

Thanks in advance

Rob

Labels (3)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@robayers 

What's the error? Try quoting the tokens

| outputcsv "$field1$$field2$.csv"

 

0 Karma

robayers
Explorer

Adding the quotes didn't help. Here is the error,

Could not write to file `""$field$"-"$field2$"".csv"':  Failed to open file for writing.  It shows the red triangle with exclamation point.

 

The file gets created using the tokens in the filename, not the value of the tokens.  I've  specified " as a token prefix and suffix in the dropdown on the dashboard.

 

0 Karma

robayers
Explorer

I  didn't mean that I used them in  the field token name, see image  below. 

 

robayers_0-1606998143462.png

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I would not use quotes as part of the token, but when you need it. You can add quotes when you need them, either surrounded by quotes or with this syntax

$field1|s$

then you just need a single surrounding quote around the outputlookup filename and the tokens themselves inside those quotes and you can include your + or - sign inside those quotes too

 

0 Karma

robayers
Explorer

That's appears to have been the problem. I removed them from the dropdown configuration and verified that they  didn't exist in the search and it worked.

Thanks for your help.

Robert

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...