Splunk Search

import and export date in a file's name

Fabien05
Explorer

Hello,

Is it possible to include the date in the name of an output file ?
example : ... | outputlookup "myname_"+function(date)+".csv"

Is it possible to extract a file .csv with the date of the file ?
example: ... | lookup filename=* date=2013-05-24

Tags (4)
0 Karma

Ayn
Legend

First question - see this question and answer. http://splunk-base.splunk.com/answers/39974/variable-file-name-in-outputcsv

Not sure exactly what you mean by your second question.

0 Karma

Ayn
Legend

I think summary indexing might be better suited for solving this problem instead. See http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Usesummaryindexing

0 Karma

Fabien05
Explorer

Thank you,

I search a way to have the average of a colomn not day by day but first day to "current" day for each day (day1 => avg(day1), day2 => avg(day1, day2), day N => avg(day1, ... , dayN).
And then to compare the value of a day with a previous average.

My idea was to save the average and the current date, then to import a previous average througt his date.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...