my search ...
| stats values(something) as nothing
| outputlookup gemini
I wish my query output to be saved in this outlook .
But when I run the above I get error "The Lookup table gemini is invalid".
I think it is asking for lookup definition .. But How do I provide the definition ..when the lookup file is the output of my query ?
actually, both "outputlook lookupname" and "outputlook lookupname.csv" works fine. just now i tested it as well.
the documentation says filename must end with .csv or .csv.gz
https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Outputlookup#Examples
but, without csv, it works fine. Last whole week i have this confusion.
on the first example, the documentation also gives the filename without ".csv" extension, but it was referring filename from transform.conf.
EDIT <submitted feedback for this documentation page>