How is the outputlookup command is configured?

[splunkettes]

Does anyone know how the outputlookup command is configured? commands.conf does not reference a python script for it. I want to change how new files are created so that they are private and assigned to an owner. 

[splunkettes · Accepted solution]

Decided to resolve the issue by creating a custom command to reassign lookup files from nobody to their proper owner based on results of splunk search. 

[richgalloway]

Outputlookup is a built-in command without an external Python script.

[splunkettes]

Thanks @richgalloway for your response. I was wondering if there is a way to modify Splunk's built in commands or at least override them with my own process. I have  a custom command that I have created that does what I want the outputlookup command to do but it would require all users to use the new command. Ideally, I would allow users to continue with the outputlookup command but change how it functions so that new files are stored in the etc/<user>/<app>/lookups directory instead of the etc/<app>/lookups directory. 

[aayushisplunk1]

Hi @splunkettes 

Please guide how you created the custom search command similar to outputlookup command. 

[sftr]

For your use case, this configuration appears to be available from within the limits.conf file:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Boutputlookup.5D

[outputlookup]
create_context = user

per the documentation:

[outputlookup]
create_context = [app|[user|system]
* Specifies the context where the lookup file will be created for the first time.
  If there is a current application context and the following options,
  file will be created under:
  * app    : etc/apps/<app>/lookups
  * user   : etc/users/<user>/<app>/lookups
  Otherwise, file will be created under:
  * system : etc/system/local/lookups
* Default: app

[richgalloway]

There's no way to override a built-in command.  Your users will have to learn to use myoutputlookup just as they once learned to use outputlookup.