Splunk Search

outputcsv sequence

simo
Path Finder

Hi all,

I have a scedulated serach every 30 minutes, which extracts a file in csv

search | outputcsv MyFile

I need to put a daily sequence in the file name

file name MyFile_01 (first file of the day) in the second extraction of the day the file name is MyFile_02

so on for all extractions.

can you help me? thanks for any answer

Best Regards,

Simone

 

Labels (1)
Tags (3)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @simo,

You can create filename count prefix based on the current hour when the scheduled search is triggered.

| outputcsv create_empty=t [| makeresults | eval hour=strftime(now(), "%H"), minutes=strftime(now(), "%M"), hour=if(minute>=30, hour*2, hour*2 + 1), filename="MyFile_".hour | return $filename]

 

If this reply helps you, an upvote/like would be appreciated.

 

0 Karma

simo
Path Finder

hi @manjunathmeti 

this might help, but if I don't extract a file because it is empty I end up with a wrong sequence.

Simone

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

create_empty=t creates empty files. But if you don't want empty files then it complicates things. 

Using Hour and minutes in the filename will be better option.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...