Splunk Search

How to generate a lookup file with outputlookup in a specific app?

vishal_bandavad
Explorer

I am using | dbquery to get the lookup details and outputlookup to generate the lookup file, but it always generates under different app (either system/lookup or app/dbx/lookup). I am trying to run the query in a search from a different app, say SampleApp.

Please let me how I can create the lookup under SampleApp? or is there any config file I need to change or any command to move the file under a certain app?

0 Karma

sanjay_shrestha
Contributor
0 Karma

sanjay_shrestha
Contributor

Running your query to generate lookup fine under SampleApp might help.

0 Karma

vishal_bandavad
Explorer

I tried , but it is creating $SPLUNK_HOME$/etc/system/lookups/ instead of $SPLUNK_HOME$/etc/apps/SampleApp/lookups

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...