Solved: Undo changes from using Outputlookup for lookup

Mary666 · ‎11-10-2021

This I know is a stupid question, but here it goes anyways, hoping someone solved this problem in the past. Does anyone know how to undo the changes to a lookup when accidently using | outputlookup ? I accidently overwrote and committed changes to my lookup and have been trying to find a way to revert my changes. Please help anyone...

bowesmana · ‎11-10-2021

Unfortunately outputlookup will overwrite the original.

Backups?

Can you recreate the lookup from an original search that created it?

View solution in original post

Mary666 · ‎11-10-2021

Hi thanks for confirming there is now way back. Lol, well I have backups... just wanted to know if I could undo the changes.

bowesmana · ‎11-10-2021

Unfortunately outputlookup will overwrite the original.

Backups?

Can you recreate the lookup from an original search that created it?

Undo changes from using Outputlookup for lookup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation