I have a search that writes to a lookup table. I would like to run this search once a month and update (overwrite) the lookup table. I see that I can schedule reports, dashboards, and alerts. Is it possible to do it with a search that writes to a lookup table file?
You can do this with schedule report or alert. As long as you have an outputlookup in the query, it should update the lookup.
Just add the outputlook command to the end of your search query.
| outputlookup <lookup_file_name>.csv
That is part of the search I run manually to update the lookup table. I'm trying to figure out how to schedule it to run monthly.
You can do this with schedule report or alert. As long as you have an outputlookup in the query, it should update the lookup.
Thank you. I was confused by the wording. I thought my search had to output a report or a dashboard.