How can I fix my outputcsv to a particular IP in search head clustering ?

[sandyIscream]

We are generating 4 reports from Splunk SHC. We want to append all the results of a search query into one particular CSV. I Tried with append in Splunk command but it is failing as the queries are too complex and output of the append query is producing few rows.

What we have done to mitigate this issue is we are generating 4 different files and a linux script to append them. but results are getting generated into different IP's.

[woodcock]

Try this:

|multisearch
[ | loadjob SavedSearch1 ]
[ | loadjob SavedSearch2 ]
[ | loadjob SavedSearch3 ]
[ | loadjob SavedSearch4 ]
| stats Your Merge Stuff Here
| outputlookup YourLookupHere

[DalJeanis]

Try 1) generating the reports with outputlookup 2) combining them with a 5th report onto the csv.