topic Re: syntax for outputlookup when defined in transforms.conf? in Splunk Search

syntax for outputlookup when defined in transforms.conf?

pavanae — Fri, 25 Oct 2019 17:45:09 GMT

I have a transforms as follows which defines a lookup

[ABC]
filename = ABC.csv
case_sensitive_match = false

Now, I am writing a saved search which updates the above lookup after executing the search.

now, which among the below should I need to specify at the end of saved search and why?

| outputlookup ABC

| outputlookup ABC.csv

Re: syntax for outputlookup when defined in transforms.conf?

starcher — Fri, 25 Oct 2019 18:10:36 GMT

You can use either. But it is good form to only use the transform definition name.

Re: syntax for outputlookup when defined in transforms.conf?

pavanae — Fri, 25 Oct 2019 18:35:24 GMT

thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?

My_Search | | outputlookup ABC

Re: syntax for outputlookup when defined in transforms.conf?

sandeepmakkena — Fri, 25 Oct 2019 18:37:52 GMT

Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.

Hope this helps, Thanks!

Re: syntax for outputlookup when defined in transforms.conf?

woodcock — Fri, 25 Oct 2019 19:47:54 GMT

Either works. If you have multiple Lookup Definitions referencing the same Lookup File, then I would use the Lookup File; if it is one-to-one, then I would use the Lookup Definition so that people understand that there is one.

Re: syntax for outputlookup when defined in transforms.conf?

woodcock — Thu, 20 Feb 2020 17:35:20 GMT

That is correct.