Hi,
I need to create a some searches, one of them dependant than the other, and save the result in csv file.
The idea is:
1. Make a search for the last 24 h and save it to a document.
2. Append the daily document to the historical one.
3. Remove duplicates in the resulting document.
These three actions should be consecutive in the schedule search, that means seconds need the first to finish, 3 need the second the finish to start.
I have been looking at the documentation but there is no much on that on Splunk 6.3.
Regards and thanks in advance.
juan
↧