https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-and-Search-Driven-Lookup/m-p/508533#M9002 <P>Having an issue with&nbsp;Enterprise Security and Search Driven Lookup.&nbsp; I've created one with manual settings, and enabled it in search, and it is reporting as running.&nbsp; But it does not see to create a lookup.&nbsp; When you use the manual setting, do you have to include the outputlookup command?&nbsp; I was thinking that you did not because you define your lookup name before you get to inputting your search.&nbsp;&nbsp;</P> Fri, 10 Jul 2020 17:55:18 GMT jerrythoms 2020-07-10T17:55:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-and-Search-Driven-Lookup/m-p/508533#M9002 <P>Having an issue with&nbsp;Enterprise Security and Search Driven Lookup.&nbsp; I've created one with manual settings, and enabled it in search, and it is reporting as running.&nbsp; But it does not see to create a lookup.&nbsp; When you use the manual setting, do you have to include the outputlookup command?&nbsp; I was thinking that you did not because you define your lookup name before you get to inputting your search.&nbsp;&nbsp;</P> Fri, 10 Jul 2020 17:55:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-and-Search-Driven-Lookup/m-p/508533#M9002 jerrythoms 2020-07-10T17:55:18Z