Splunk Search

Is it possible to use outputlookup to append results to a lookup table?

Communicator

I want to create a single lookup table based on the results of three different searches. I've tried using subsearches to accomplish this, but I always get errors saying the search is too big.

Or is the only way to do this to create one lookup table for each search and then run another search that makes lookups to each of the three tables and then writes the output to another lookup table?

Thx.

Craig

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.

View solution in original post

Motivator
0 Karma

Splunk Employee
Splunk Employee

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.

View solution in original post