Splunk Search

Is there a way to pass the current date into the outputlookup file name?

Path Finder

Is there a way to pass current date into outputlookup file name?

For instance I created and append my lookup file with LOG_ID=362826361 (this is a search generated by workflow action [when user sees a new event, clicks on it and invokes appending of the lookupfile]):


index=opsmon sourcetype=opsmonitor LOG_ID=362826361 |table LOG_ID |outputlookup append=true ackevents.csv

Then on a dashboard called ACK Events I pass contents of ackevents.csv to display list of events that were acknowledged:

index=opsmon sourcetype=opsmonitor EVENT_MSG=* [|inputlookup ackevents.csv] |stats list(EVENT_MSG) by _time, LOG_LEVEL , APP_DOMAIN,HOST_NAME, LOG_ID | sort - _time

At the same time the original dashboard Excludes the ACK'ed events.

The lookup file however will grow over time, which is something I'd like to avoid - hence generate a new file every day ( by means of creating it with a date in the file name).

Any ideas?

Thanks,

1 Solution

SplunkTrust
SplunkTrust

Sure. Define a macro like this:

[today]
definition = strftime(time(), "%Y-%m-%d")
iseval = 1

and use it in your search like this:

... | outputlookup foo_`today`.csv

gives me this output:

Results written to file 'C:\Program Files\Splunk\etc\apps\search\lookups\foo_2014-10-29.csv' on serverName='Martin-PC'

View solution in original post

Champion

Hi @vumanhtai

If you try to define a macro using conf file then put the entry macros.conf in the corresponding app folder. Let me know any issues

[today]
definition = strftime(time(), "%Y-%m-%d")
iseval = 1

if you try using UI then it should be

alt text

0 Karma

Path Finder

thank you so much

0 Karma

Path Finder

Hi all
i added new macros like this :
alt text

but my search : | outputlookup test_today.csv is not working
how do i add the "today" macro to make it work

0 Karma

SplunkTrust
SplunkTrust

Sure. Define a macro like this:

[today]
definition = strftime(time(), "%Y-%m-%d")
iseval = 1

and use it in your search like this:

... | outputlookup foo_`today`.csv

gives me this output:

Results written to file 'C:\Program Files\Splunk\etc\apps\search\lookups\foo_2014-10-29.csv' on serverName='Martin-PC'

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!