Splunk Search

How to push the search query to lookup file

vivek_manoj
Explorer

If I write a search query and want to push the search query code to my lookup. Ho to do it??

Tags (1)
0 Karma

gehinger
Engager

The query itself won't give you this ability.

However, all queries are stored in the _audit index. So you could search this index for the desired queries and then output the result into a lookup file.

index=_audit action=search
0 Karma

DalJeanis
Legend

is it the code you want to push, or the output?

0 Karma

vivek_manoj
Explorer

Yes, I want to push the splunk query code in lookup.

For Example : - index="_internal" and I want to push index="_internal" into the lookup.

0 Karma

adonio
Ultra Champion

just throwing out there but if you want to capture the searches, you can go with something like this:
| history | table _time search | outputlookup searches.csv

0 Karma

rjthibod
Champion

The community more details about your queries and lookup in order to be helpful.

Please provide a summary of what is stored in the lookup and what your queries look like.

0 Karma

adonio
Ultra Champion

if the results are what youre looking for, just pipe to table and outputlookup. something like that:
my base search | table field1 field2 fieldn | ouputlookup mysearch.csv

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...