Splunk Search

Multiple csvs in one search

yuwtennis
Communicator

Hi!

I am creating a search that needs to create 2 csvs in one search.

Best way is to

search xxxxx | ..... | outputcsv test.csv | outputcsv test2.csv.

but this is not good.

Is there a way to implement this?

Thanks,
Yu

Tags (2)
0 Karma

yuwtennis
Communicator

Hello adityapavan18.

Thank you for the reply.

I have to create two files that does following things.

  1. Keep Track of overall number of events processed in schedule events.

  2. Create fields for external application by csv

These two has to be done in one search.

Thanks,
Yu

0 Karma

norbert_hamel
Communicator

You can append a 2nd search, something like:

index=myindex | head 5 | outputlookup test1.csv | append [ search index=myindex head 10 | outputlookup test2.csv ]

0 Karma

yuwtennis
Communicator

Hello norber.

Thank you for the reply.

But this way its like two different search exists in one search.

I want to do something like:

index = myindex | eval f1 = 1 | eval f2 = 2 | table f1 | outputcsv test1.csv | table f2 | outputcsv test2.csv

Would this be possible?

Thanks,
Yu

0 Karma

adityapavan18
Contributor

I think that is the only way to create same copies of a csv
out of curiosity..why do you need two files.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...