Splunk Search

How to update the lookup table before the scheduled search runs so it gives all lookup entries?

Nam7Splnk
Explorer

I have scheduled search that periodically updates lookup table CSV file every 15 minutes. I updated this lookup with below search query before scheduled search runs.

| inputlookup lookuptable1 | outputlookup lookuptable2 append=true 

I am able to see lookup table entries until the next time for the scheduled search but once scheduled search runs, all my new lookup entries from above search are gone.

I tried this on Standalone Search Head as well as SH cluster and the behavior is the same.

Any idea how to update this lookup table?

0 Karma
1 Solution

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

View solution in original post

0 Karma

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...