Splunk Search

Is it possible to use a search value or a token in the outputlookup name?

iKate
Builder

Hi!

Is it possible to pass into lookup's name created by outputlookup command a token or a search value?

Smth like this:

index=foo 
| eval week=<here comes some evaluation, e.g. number of week>
| outputlookup dataset_$week$.csv

I've tried to write it differently, but outputlookup eats all sorts of symbols and just creates files with $ ' " ` in its name while I wanted dataset_15.csv

1 Solution

ryanoconnor
Builder

The map command should be able to handle this. For example:

index=* host=sample_host | dedup host  | map search="search * | outputlookup $host$.csv"

View solution in original post

0 Karma

ryanoconnor
Builder

The map command should be able to handle this. For example:

index=* host=sample_host | dedup host  | map search="search * | outputlookup $host$.csv"
0 Karma

iKate
Builder

Wow! It works, thank you!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...