Reporting

Adding search time range to outputcsv

pete_charlton
Explorer

I have two searches appended together piped to a table_raw and dumped to an outputcsv and run this as a nightly report. The report is set to run at midnight and capture the previous 24hours of data. Is there a way to put the search time into the outputcsv file to use for auditing purposes?

Search example

index=index1 source=log1 "string of text" "string of text" | append [search index=index2 source=log2 Field=value] | table _raw | outputcsv filename.csv

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

You can add the command at the end | addinfo | table _raw info_*

it will add to each event the field : info_max_time info_min_time info_search_time info_sid from time search details in epoch time.

example :

alt text

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...