topic Re: outputlookup configurations in Knowledge Management

How is the outputlookup command is configured?

splunkettes — Wed, 05 Aug 2020 05:50:56 GMT

Does anyone know how the outputlookup command is configured? commands.conf does not reference a python script for it. I want to change how new files are created so that they are private and assigned to an owner.

Re: outputlookup configurations

richgalloway — Tue, 04 Aug 2020 16:44:30 GMT

Outputlookup is a built-in command without an external Python script.

Re: outputlookup configurations

splunkettes — Tue, 04 Aug 2020 22:39:49 GMT

Thanks @richgalloway for your response. I was wondering if there is a way to modify Splunk's built in commands or at least override them with my own process. I have a custom command that I have created that does what I want the outputlookup command to do but it would require all users to use the new command. Ideally, I would allow users to continue with the outputlookup command but change how it functions so that new files are stored in the etc/<user>/<app>/lookups directory instead of the etc/<app>/lookups directory.

Re: outputlookup configurations

richgalloway — Mon, 26 Dec 2022 16:20:33 GMT

There's no way to override a built-in command. Your users will have to learn to use myoutputlookup just as they once learned to use outputlookup.

Re: How is the outputlookup command is configured?

splunkettes — Sat, 08 Aug 2020 19:38:51 GMT

Decided to resolve the issue by creating a custom command to reassign lookup files from nobody to their proper owner based on results of splunk search.

Re: outputlookup configurations

sftr — Wed, 20 Apr 2022 12:52:15 GMT

For your use case, this configuration appears to be available from within the limits.conf file:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Boutputlookup.5D

[outputlookup] create_context = user

per the documentation:

[outputlookup]
create_context = [app|[user|system]
* Specifies the context where the lookup file will be created for the first time.
  If there is a current application context and the following options,
  file will be created under:
  * app    : etc/apps/<app>/lookups
  * user   : etc/users/<user>/<app>/lookups
  Otherwise, file will be created under:
  * system : etc/system/local/lookups
* Default: app

Re: outputlookup configurations

aayushisplunk1 — Mon, 26 Dec 2022 13:55:44 GMT

Hi @splunkettes

Please guide how you created the custom search command similar to outputlookup command.