I have an application named "TA-training_samaksh_for_splunk". I have to run the following query
index="training_samaksh" source="/home/devuser/tutorialdata/www1/access.log" | table ip_address, request_method,time_taken | outputlookup createinapp=true testwritecsv_lookup
The transforms.conf has the following lookup defined
[testwritecsv_lookup]
filename = test.csv
The "test.csv" file always get created/updated in the "/splunk/etc/apps/search/lookups" or "/spunk/etc/users/<username>/TA-training_samaksh_for_splunk/lookups" and not in "/splunk/etc/apps/TA-training_samaksh_for_splunk/lookups" even though I am running the search within the app.
Any solution for this?
