Getting Data In

outputcsv: How to include the current Splunk user ID and date in the CSV file name? (ex: splunkuserid_date.csv)

remnant_8
Explorer

I want output csv like this "splunkuserid_data.csv" automatically. For example:
admin_17_05_16_09_07_58.csv
I tried this search:

my search | outputcsv [| stats count | addinfo | eval filename=strftime(now(), "filename_%d_%m_%y_%H_%M_%S") | return $filename ] 

I know how to get get the current Splunk user id with |rest /services/authentication/current-context splunk_server=local | fields username, but I don't know how to include the Splunk user id in the CSV file name

Does anyone have an idea?

1 Solution

remnant_8
Explorer

I used SPL like this 🙂

my search | outputcsv  [ | rest /services/authentication/current-context splunk_server=local | eval time=strftime(now(), "%Y_%m_%d_%H_%M_%S") | fields username time | eval csvnm = toString(username) + "_" +toString(time) | return $csvnm] 

View solution in original post

remnant_8
Explorer

I used SPL like this 🙂

my search | outputcsv  [ | rest /services/authentication/current-context splunk_server=local | eval time=strftime(now(), "%Y_%m_%d_%H_%M_%S") | fields username time | eval csvnm = toString(username) + "_" +toString(time) | return $csvnm] 
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...