https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123297#M33277 <P>Could anyone tell me the difference between outputlookup and outputcsv?</P> <P>If there no differences, is there any specifications to use the above in various circumstances?</P> <P>Regards,<BR /> Naga</P> Wed, 15 Jul 2015 09:09:43 GMT splunkn 2015-07-15T09:09:43Z https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123297#M33277 <P>Could anyone tell me the difference between outputlookup and outputcsv?</P> <P>If there no differences, is there any specifications to use the above in various circumstances?</P> <P>Regards,<BR /> Naga</P> Wed, 15 Jul 2015 09:09:43 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123297#M33277 splunkn 2015-07-15T09:09:43Z https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123298#M33278 <P>There is a major difference. <CODE>outputlookup</CODE> will use the defined transforms or the filename you give it and put the CSV file in the <CODE>lookups</CODE> folder of the current App context. You can use this lookup in other commands using the <CODE>lookup</CODE> command. Changes to the lookup are replicated on the SHC.</P> <P><CODE>outputcsv</CODE> just dumps the CSV to the file system in <CODE>$SPLUNK_HOME/var/run/splunk/</CODE>. You can't use it later, and changes are not replicated in a SHC.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Outputcsv">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Outputcsv</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Outputlookup">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Outputlookup</A></P> Wed, 15 Jul 2015 12:42:25 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123298#M33278 alacercogitatus 2015-07-15T12:42:25Z https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123299#M33279 <P>@splunkn, instead of giving me Karma points, use the Up arrow to vote on the answer. This does two things. 1) It won't take away your Karma and 2) shows others it was a valuable answer. Your points have been returned, but thanks!</P> Wed, 15 Jul 2015 20:49:13 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123299#M33279 alacercogitatus 2015-07-15T20:49:13Z https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123300#M33280 <P>Can you clarify "You can't use it later" comment for outputcsv command? The data is very much accessible through <CODE>| inputcsv</CODE> - I use this all the time.</P> Fri, 23 Mar 2018 18:26:39 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123300#M33280 JCISplunker 2018-03-23T18:26:39Z https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123301#M33281 <P>Yes. we can access the results with |inputcsv command. </P> <P>I guess the major differences are<BR /> 1) Location where it stores<BR /> 2) SHC replication</P> Mon, 08 Oct 2018 05:21:02 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/123301#M33281 kasu_praveen 2018-10-08T05:21:02Z https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/698136#M237106 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/3514">@alacercogitatus</a>do you know if <SPAN>Splunk has a cleanup/garbage collection for these CSVs, or do they live forever?</SPAN></P> Tue, 03 Sep 2024 19:52:44 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputlookup-and-outputcsv/m-p/698136#M237106 ejwade 2024-09-03T19:52:44Z