Splunk Search

Is it possible to use outputlookup to append results to a lookup table?

jambajuice
Communicator

I want to create a single lookup table based on the results of three different searches. I've tried using subsearches to accomplish this, but I always get errors saying the search is too big.

Or is the only way to do this to create one lookup table for each search and then run another search that makes lookups to each of the three tables and then writes the output to another lookup table?

Thx.

Craig

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.

View solution in original post

ftk
Motivator

araitz
Splunk Employee
Splunk Employee

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!