index="URL" NOT [inputlookup A_list_Jan1.csv | fields gtld]
| inputlookup A_listJan1.csv append=true
| dedup gtld
| table gtld
| outputlookup [ | stats count | eval filename=strftime(now(), "B_list%b%d.csv") | return $filename]
QUESTION:
I want to run this search daily. Is there anyway I can automate this search so that "B_list%b%d.csv" gets inserted as the first "inputlookup". This would result in the next days outputlookup as "C_list%b%d.csv".
REASON:
I see 100's of new gtld's on daily basis and I'm making a list of "total gtld's seen".
SECONDARY GOAL:
Create a second daily list of only the new gtld's seen for that day.
... View more