Splunk Search

How can I fix my outputcsv to a particular IP in search head clustering ?


We are generating 4 reports from Splunk SHC. We want to append all the results of a search query into one particular CSV. I Tried with append in Splunk command but it is failing as the queries are too complex and output of the append query is producing few rows.

What we have done to mitigate this issue is we are generating 4 different files and a linux script to append them. but results are getting generated into different IP's.

0 Karma

Esteemed Legend

Try this:

[ | loadjob SavedSearch1 ]
[ | loadjob SavedSearch2 ]
[ | loadjob SavedSearch3 ]
[ | loadjob SavedSearch4 ]
| stats Your Merge Stuff Here
| outputlookup YourLookupHere
0 Karma


Try 1) generating the reports with outputlookup 2) combining them with a 5th report onto the csv.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...