I have 5 input CSV files received everyday. How can they be appended and stored everyday as one report when received? On any particular day, I want to have the details extracted from the 5 CSV input files, consolidate them in one report, and send this out in an email. How do I achieve this?
Thanks in advance!
Something like this may work.
| inputlookup file1.csv | append [| inputlookup file2.csv] | append | inputlookup file3.csv] and so on | commands to generate your report
Once you have the right report, you can schedule it to run automatically
http://docs.splunk.com/Documentation/Splunk/6.4.2/Report/Schedulereports