Is it possible to use outputlookup to append results to a lookup table?

[jambajuice]

I want to create a single lookup table based on the results of three different searches. I've tried using subsearches to accomplish this, but I always get errors saying the search is too big.

Or is the only way to do this to create one lookup table for each search and then run another search that makes lookups to each of the three tables and then writes the output to another lookup table?

Thx.

Craig

[ftk]

There is another example of this right here on Answers: http://answers.splunk.com/questions/3982/correlate-and-tag-splunk-events-with-change-control-tickets

[araitz · Accepted solution]

Yup, I just blogged on a very similar topic:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

Essentially, you need to get the set of results that you want to append via search, use inputlookup to input the current contents of the lookup, then use outputlookup to write the lookup.