Dynamic outputlookup file name

[Fadom1013]

Hello ! Need your help splunkers !

I want to append or create a csv for each rows of my query 🙂

I do this for assignate the fields to the file_name  : 

| .. query

| foreach *
[
| eval customer_name  = if("<<FIELD>>" = "nom_site", "DATA_".'<<FIELD>>'.".csv", "Error")
| outputlookup  append=true customer_name
]

Error in 'outputlookup' command: The lookup table 'customer_name' is invalid. 
(I try with $customer_name$ and $customer_name too).

And I do a second try like this, with a lookup search: 

| ... query

| foreach *
[
| eval customer_name  = if("<<FIELD>>" = "nom_site", '<<FIELD>>', "Error")

| outputlookup  append=true [| inputlookup customers.csv | search name=customer_name | eval name_file = "DATA_".name.".csv" | return $name_file)] 
]

 Error : Error in 'outputlookup' command: A lookup table name or file name is required.

And finaly, I do with a call of a macro (who contains the precedent lookup search)  : 

| ... query

| foreach *
[
| eval customer_name  = if("<<FIELD>>" = "nom_site", '<<FIELD>>', "Error")

| outputlookup  append=true `name_to_csv(customer_name)`
]

 
Thanks for your help.
Have a  nice day 🙂

[richgalloway]

I don't understand what you are trying to do.  You say you want to "append or create a csv for each rows", but the foreach command loops over each *field* rather than each row.  To loop over each row, use the map command.

| ... query
| map search="| outputlookup append=true $customer_name$"

What problem are you trying to solve?