Splunk Search

Is it possible to use a search value or a token in the outputlookup name?

iKate
Builder

Hi!

Is it possible to pass into lookup's name created by outputlookup command a token or a search value?

Smth like this:

index=foo 
| eval week=<here comes some evaluation, e.g. number of week>
| outputlookup dataset_$week$.csv

I've tried to write it differently, but outputlookup eats all sorts of symbols and just creates files with $ ' " ` in its name while I wanted dataset_15.csv

1 Solution

ryanoconnor
Builder

The map command should be able to handle this. For example:

index=* host=sample_host | dedup host  | map search="search * | outputlookup $host$.csv"

View solution in original post

0 Karma

ryanoconnor
Builder

The map command should be able to handle this. For example:

index=* host=sample_host | dedup host  | map search="search * | outputlookup $host$.csv"
0 Karma

iKate
Builder

Wow! It works, thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...