topic Need help understanding Appending to Lookup file in Splunk Search

topic Need help understanding Appending to Lookup file in Splunk Search https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584960#M203784 <P>Hi All,<BR />I have the below search.  I am being told it appends results to a lookup table called <STRONG>user_ids</STRONG>.   </P> <P> </P> <LI-CODE lang="markup">index=ad earliest=-15d |stats latest(_time) as _time, latest(profile.department) as bunit, latest(profile.legacyUsername) as legacyUsername, latest(profile.userType) as category by userID | append [|inputlookup user_ids]</LI-CODE> <P> </P> <P><BR />In all the posts i have seen so far, people recommend using <STRONG>outputlookup</STRONG> command to append  <BR /><BR />Can someone pls explain  how does <STRONG>append [|inputlookup user_identities] </STRONG> end up appending  in my case ? How is this different than </P> <PRE>| outputlookup append=true user_ids.csv </PRE> Mon, 14 Feb 2022 18:37:59 GMT neerajs_81 2022-02-14T18:37:59Z Need help understanding Appending to Lookup file https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584960#M203784 <P>Hi All,<BR />I have the below search.  I am being told it appends results to a lookup table called <STRONG>user_ids</STRONG>.   </P> <P> </P> <LI-CODE lang="markup">index=ad earliest=-15d |stats latest(_time) as _time, latest(profile.department) as bunit, latest(profile.legacyUsername) as legacyUsername, latest(profile.userType) as category by userID | append [|inputlookup user_ids]</LI-CODE> <P> </P> <P><BR />In all the posts i have seen so far, people recommend using <STRONG>outputlookup</STRONG> command to append  <BR /><BR />Can someone pls explain  how does <STRONG>append [|inputlookup user_identities] </STRONG> end up appending  in my case ? How is this different than </P> <PRE>| outputlookup append=true user_ids.csv </PRE> Mon, 14 Feb 2022 18:37:59 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584960#M203784 neerajs_81 2022-02-14T18:37:59Z Re: Appending to Lookup file https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584965#M203785 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229059">@neerajs_81</a>,</P><P>the append command is use to append the results of a subsearch (also from a lookup) to the results of the main search.</P><P>If I correctly understood, you need to append the results of a search to a lookup, if this is correct, you have to use the outputlookup.</P><P>You can find information about both the commands at </P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Append" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Append</A> </P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Outputlookup" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Outputlookup</A></P><P>Ciao.</P><P>Giuseppe</P> Mon, 14 Feb 2022 11:40:46 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584965#M203785 gcusello 2022-02-14T11:40:46Z Re: Appending to Lookup file https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584969#M203786 <P>Thanks. So in my search what does </P><PRE>| append [|inputlookup user_ids]</PRE><P>achieve?   Is it appending the results to that user_ids lookup file ? </P> Mon, 14 Feb 2022 12:01:19 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584969#M203786 neerajs_81 2022-02-14T12:01:19Z Re: Appending to Lookup file https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584971#M203787 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229059">@neerajs_81</a>,</P><P>no it appends the rows of the lookup TO your search results, not To the lookup!</P><P>In other words: "| append [|inputlookup user_ids]" appends FROM user_id.csv not TO this lookup.</P><P>Ciao.</P><P>Giuseppe</P> Mon, 14 Feb 2022 12:03:47 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-understanding-Appending-to-Lookup-file/m-p/584971#M203787 gcusello 2022-02-14T12:03:47Z