topic Re: Can I schedule a search that writes to a lookup table? in Splunk Search

Can I schedule a search that writes to a lookup table?

ilhwan — Fri, 04 Nov 2022 20:18:10 GMT

I have a search that writes to a lookup table. I would like to run this search once a month and update (overwrite) the lookup table. I see that I can schedule reports, dashboards, and alerts. Is it possible to do it with a search that writes to a lookup table file?

Re: Can I schedule a search that writes to a lookup table?

johnhuang — Fri, 04 Nov 2022 21:45:31 GMT

Just add the outputlook command to the end of your search query.

| outputlookup <lookup_file_name>.csv

Re: Can I schedule a search that writes to a lookup table?

ilhwan — Fri, 04 Nov 2022 21:47:32 GMT

That is part of the search I run manually to update the lookup table. I'm trying to figure out how to schedule it to run monthly.

Re: Can I schedule a search that writes to a lookup table?

johnhuang — Fri, 04 Nov 2022 21:49:33 GMT

You can do this with schedule report or alert. As long as you have an outputlookup in the query, it should update the lookup.

Re: Can I schedule a search that writes to a lookup table?

ilhwan — Fri, 04 Nov 2022 23:15:20 GMT

Thank you. I was confused by the wording. I thought my search had to output a report or a dashboard.