Splunk Search

How to update the lookup table before the scheduled search runs so it gives all lookup entries?

Nam7Splnk
Explorer

I have scheduled search that periodically updates lookup table CSV file every 15 minutes. I updated this lookup with below search query before scheduled search runs.

| inputlookup lookuptable1 | outputlookup lookuptable2 append=true 

I am able to see lookup table entries until the next time for the scheduled search but once scheduled search runs, all my new lookup entries from above search are gone.

I tried this on Standalone Search Head as well as SH cluster and the behavior is the same.

Any idea how to update this lookup table?

0 Karma
1 Solution

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

View solution in original post

0 Karma

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...