Can I schedule a search that writes to a lookup table?

[ilhwan]

I have a search that writes to a lookup table.  I would like to run this search once a month and update (overwrite) the lookup table.  I see that I can schedule reports, dashboards, and alerts.  Is it possible to do it with a search that writes to a lookup table file?

[johnhuang]

Just add the outputlook command to the end of your search query.

| outputlookup <lookup_file_name>.csv

[ilhwan]

That is part of the search I run manually to update the lookup table.  I'm trying to figure out how to schedule it to run monthly.

[johnhuang · Accepted solution]

You can do this with schedule report or alert. As long as you have an outputlookup in the query, it should update the lookup.

[ilhwan]

Thank you.  I was confused by the wording.  I thought my search had to output a report or a dashboard.