https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656357#M226704 <P>Hi</P><P>here is the simplest way</P><LI-CODE lang="markup">| makeresults | search foo | outputlookup foo.csv</LI-CODE><P>&nbsp;</P><P>Basically you should create "empty" resultset and then forward it to outputlookup command.</P><P>r. Ismo&nbsp;</P> Fri, 01 Sep 2023 05:54:16 GMT isoutamo 2023-09-01T05:54:16Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656356#M226703 <P>How to create empty.csv lookup in web</P> Fri, 01 Sep 2023 05:51:05 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656356#M226703 Siddharthnegi 2023-09-01T05:51:05Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656357#M226704 <P>Hi</P><P>here is the simplest way</P><LI-CODE lang="markup">| makeresults | search foo | outputlookup foo.csv</LI-CODE><P>&nbsp;</P><P>Basically you should create "empty" resultset and then forward it to outputlookup command.</P><P>r. Ismo&nbsp;</P> Fri, 01 Sep 2023 05:54:16 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656357#M226704 isoutamo 2023-09-01T05:54:16Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656360#M226705 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Siddharthnegi_0-1693548364652.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27035i9A1F915E22143C6A/image-size/medium?v=v2&amp;px=400" role="button" title="Siddharthnegi_0-1693548364652.png" alt="Siddharthnegi_0-1693548364652.png" /></span></P><P>can i use xlsx file . here</P> Fri, 01 Sep 2023 06:06:35 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656360#M226705 Siddharthnegi 2023-09-01T06:06:35Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656361#M226706 <P>No you can't. Excels xlsx file's format is something else than ASCII/UTF-8 text with separator. It's somekind of XML file.</P><P>If you want to use files from Excel you should export those to CSV before use. Then you can use that CSV file.</P><P>On splunkbase there seems to be app&nbsp;<A href="https://splunkbase.splunk.com/app/6969" target="_blank">https://splunkbase.splunk.com/app/6969</A>. Unfortunately it seems to be licensed or something similar as it's not freely downloable. Also it just export data to excel not read from excel, if I have understood right.</P> Fri, 01 Sep 2023 06:16:11 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656361#M226706 isoutamo 2023-09-01T06:16:11Z https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656380#M226713 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/257462">@Siddharthnegi</a>&nbsp;,</P><P>in addition, remember to create a lookup definition [Settings &gt; Lookups &gt; Lookup Definition] otherwise you cannot fully use the lookup.</P><P>Ciao.</P><P>Giuseppe</P> Fri, 01 Sep 2023 08:10:37 GMT https://community.splunk.com/t5/Splunk-Search/splunk/m-p/656380#M226713 gcusello 2023-09-01T08:10:37Z