Splunk Search

outputcsv sequence

simo
Path Finder

Hi all,

I have a scedulated serach every 30 minutes, which extracts a file in csv

search | outputcsv MyFile

I need to put a daily sequence in the file name

file name MyFile_01 (first file of the day) in the second extraction of the day the file name is MyFile_02

so on for all extractions.

can you help me? thanks for any answer

Best Regards,

Simone

 

Labels (1)
Tags (3)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @simo,

You can create filename count prefix based on the current hour when the scheduled search is triggered.

| outputcsv create_empty=t [| makeresults | eval hour=strftime(now(), "%H"), minutes=strftime(now(), "%M"), hour=if(minute>=30, hour*2, hour*2 + 1), filename="MyFile_".hour | return $filename]

 

If this reply helps you, an upvote/like would be appreciated.

 

0 Karma

simo
Path Finder

hi @manjunathmeti 

this might help, but if I don't extract a file because it is empty I end up with a wrong sequence.

Simone

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

create_empty=t creates empty files. But if you don't want empty files then it complicates things. 

Using Hour and minutes in the filename will be better option.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...