Splunk Search

Combining multiple independent searches result into excel/csv file and send a single mail

chintan_shah
Path Finder

Hi, i have a requirement of combining multiple independent searches into a single excel/csv file and schedule a single email for sending the results.
can anyone help me out please?

Tags (1)
0 Karma

woodcock
Esteemed Legend

You can use some combination of the following commands (read the dox and make a decision): inputcsv, outputcsv, loadjob, savesearch, sendemail.

0 Karma

chintan_shah
Path Finder

Thanks for your response. but i missed a point where i want all the results to be in separate tabs.

0 Karma

woodcock
Esteemed Legend

Impossible with native splunk but there may be something like this on splunkbase (I doubt it).

0 Karma

chintan_shah
Path Finder

Thanks Woodcock for your help.

0 Karma

pradeepkumarg
Influencer

Schedule your multiple independent searches and update the lookup for each search using | outputlookup [append=true]. Then have another search scheduled at a slightly later point of time to read from this lookup and email the results

There is another solution where you can club all your independent searches into one search using append. You might hit into sub search limit issues this way

 search1 append [search 2]

0 Karma

chintan_shah
Path Finder

Thanks for your response. but i missed a point where i want all the results to be in separate tabs.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...