Is there a way to pass the current date into the outputlookup file name?

[mic1024]

Is there a way to pass current date into outputlookup file name?

For instance I created and append my lookup file with LOG_ID=362826361 (this is a search generated by workflow action [when user sees a new event, clicks on it and invokes appending of the lookupfile]):


index=opsmon sourcetype=opsmonitor LOG_ID=362826361 |table LOG_ID |outputlookup append=true ackevents.csv


Then on a dashboard called ACK Events I pass contents of ackevents.csv to display list of events that were acknowledged:

index=opsmon sourcetype=opsmonitor EVENT_MSG=* [|inputlookup ackevents.csv] |stats list(EVENT_MSG) by _time, LOG_LEVEL , APP_DOMAIN,HOST_NAME, LOG_ID | sort - _time


At the same time the original dashboard Excludes the ACK'ed events.

The lookup file however will grow over time, which is something I'd like to avoid - hence generate a new file every day ( by means of creating it with a date in the file name).

Any ideas?

Thanks,

[vnravikumar]

Hi @vumanhtai

If you try to define a macro using conf file then put the entry macros.conf in the corresponding app folder. Let me know any issues

[today]
definition = strftime(time(), "%Y-%m-%d")
iseval = 1

if you try using UI then it should be

[vumanhtai]

thank you so much

[vumanhtai]

Hi all
i added new macros like this :

but my search : | outputlookup test_today.csv is not working
how do i add the "today" macro to make it work

[martin_mueller · Accepted solution]

Sure. Define a macro like this:

[today]
definition = strftime(time(), "%Y-%m-%d")
iseval = 1

and use it in your search like this:

... | outputlookup foo_`today`.csv

gives me this output:

Results written to file 'C:\Program Files\Splunk\etc\apps\search\lookups\foo_2014-10-29.csv' on serverName='Martin-PC'