Splunk Search

Splunk script to update VA report weekly using lookup file

aferns0804
Engager

I am running a search job to view Vulnerability results/data. The search runs every week Saturday evening.  

I want to dump the results into a lookup file which will run automatically every saturday and it should replaced the previous weeks  report with new updated results. (Lookup needs to be same) 

For eg 20th March 2021 lookup file should be automatically replaced by results from 27th 2021 march search.

I don't need the old report(20th march) data since it will be outdated and will consume space on my server. 

 

 

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @aferns0804 

If your report is relatively small then go with CSV lookups and following example query would help to create  assuming the search job user having enough rights to run outputlook.

 

<your query> | fields field1, field2, field3, field4... |  outputlookup <your_saturday_report>.csv

 

You can read more about it here - About lookups - Splunk Documentation

-----------------------------------------------------

An upvote would be appreciated if it helps!

View solution in original post

Tags (2)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @aferns0804 

Please try this instead of fields command use table.

<your query> | table field1, field2, field3, field4... |  outputlookup <your_saturday_report>.csv

-----------------------------------------------------

An upvote would be appreciated if it helps!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @aferns0804 

If your report is relatively small then go with CSV lookups and following example query would help to create  assuming the search job user having enough rights to run outputlook.

 

<your query> | fields field1, field2, field3, field4... |  outputlookup <your_saturday_report>.csv

 

You can read more about it here - About lookups - Splunk Documentation

-----------------------------------------------------

An upvote would be appreciated if it helps!

Tags (2)
0 Karma

aferns0804
Engager

Done, thanks but it is also exporting _raw  and _time events to the outputlookup file. 

I m not sure it is doing that. I don't want _raw events in my outputlookup file

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...