Split output of query into separate files

[andreaswpv]

Running queries on really large sets of data, and sending the output to an outputlookup works well for weekly refreshed dashboards. Is there a way to have some numbers from the initial report go into a separate, second outputlookup for monthly tracking? 

For example a weekly report or dashboard shows me details on a daily basis, and the weekly summary - great. 
Now the weekly summary should go additionally to a separate file for the monthly view. Is there a way to 'tee' results to different outputlookups? 

[etoombs · Accepted solution]

Yes, you can do this.  As you chain the outputlookups, put the most broad search first. As you summarize the different items you need, you can write to additional lookup files using append, or even bring in another file, do stats processing, and then write it back out. 

<run your initial search, for the daily data>

|outputlookup dailyfile.csv 

<add the fully daily info to the weekly file, or do whatever summation is necessary>

|outputlookup append=true weeklyfile.csv

<bring in existing monthly data, and summarize it. then write it back out>

|append

[|inputlookup monthlyfile.csv] 

|stats <summarize whatever>

|outputlookup monthlyfile.csv

[ITWhisperer]

You can have multiple outputlookup commands in the same search so you can append each week's results to the monthly lookup and then inputlookup at the end of the month to process the monthly results