Splunk Search

Is it possible to use outputlookup to append results to a lookup table?

jambajuice
Communicator

I want to create a single lookup table based on the results of three different searches. I've tried using subsearches to accomplish this, but I always get errors saying the search is too big.

Or is the only way to do this to create one lookup table for each search and then run another search that makes lookups to each of the three tables and then writes the output to another lookup table?

Thx.

Craig

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.

View solution in original post

ftk
Motivator

araitz
Splunk Employee
Splunk Employee

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...