All Apps and Add-ons

Why is Lookup file not being created within app context?


I have an application named "TA-training_samaksh_for_splunk". I have to run the following query


index="training_samaksh" source="/home/devuser/tutorialdata/www1/access.log" | table ip_address, request_method,time_taken | outputlookup createinapp=true testwritecsv_lookup


The transforms.conf has the following lookup defined

filename = test.csv

The "test.csv" file always get created/updated in the "/splunk/etc/apps/search/lookups" or "/spunk/etc/users/<username>/TA-training_samaksh_for_splunk/lookups" and not in "/splunk/etc/apps/TA-training_samaksh_for_splunk/lookups" even though I am running the search within the app. 

Any solution for this?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...