Splunk Search

How to push the search query to lookup file

vivek_manoj
Explorer

If I write a search query and want to push the search query code to my lookup. Ho to do it??

Tags (1)
0 Karma

gehinger
Engager

The query itself won't give you this ability.

However, all queries are stored in the _audit index. So you could search this index for the desired queries and then output the result into a lookup file.

index=_audit action=search
0 Karma

DalJeanis
Legend

is it the code you want to push, or the output?

0 Karma

vivek_manoj
Explorer

Yes, I want to push the splunk query code in lookup.

For Example : - index="_internal" and I want to push index="_internal" into the lookup.

0 Karma

adonio
Ultra Champion

just throwing out there but if you want to capture the searches, you can go with something like this:
| history | table _time search | outputlookup searches.csv

0 Karma

rjthibod
Champion

The community more details about your queries and lookup in order to be helpful.

Please provide a summary of what is stored in the lookup and what your queries look like.

0 Karma

adonio
Ultra Champion

if the results are what youre looking for, just pipe to table and outputlookup. something like that:
my base search | table field1 field2 fieldn | ouputlookup mysearch.csv

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...