Splunk Search

How can I fix my outputcsv to a particular IP in search head clustering ?


We are generating 4 reports from Splunk SHC. We want to append all the results of a search query into one particular CSV. I Tried with append in Splunk command but it is failing as the queries are too complex and output of the append query is producing few rows.

What we have done to mitigate this issue is we are generating 4 different files and a linux script to append them. but results are getting generated into different IP's.

0 Karma

Esteemed Legend

Try this:

[ | loadjob SavedSearch1 ]
[ | loadjob SavedSearch2 ]
[ | loadjob SavedSearch3 ]
[ | loadjob SavedSearch4 ]
| stats Your Merge Stuff Here
| outputlookup YourLookupHere
0 Karma


Try 1) generating the reports with outputlookup 2) combining them with a 5th report onto the csv.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!