Splunk Search

how to transform a search into a csv file in order to query the csv instead the index

jip31
Motivator

hello

I have done a saved search scheduled one time per day from the query below

    index=toto sourcetype="tutu" host=3154 | outputlookup test.csv

I have done an outputlookup test.csv because I need to export data in a csv file
If I am doing this does it going to save this file in the lookup table?
What I need is to save this file because I want to be able to do an | inputlookup test.csv in other query
Is it the good process please??
thanks for your help

Tags (1)
0 Karma
1 Solution

hunderliggur
Path Finder

You are going to get a lot of fields in your outputlookup that you may not really need. You might consider adding a fields command to just put what you want in the lookup.

Alternatively, you may consider using a subsearch in your "other query" and skip the lookup altogether,

View solution in original post

0 Karma

hunderliggur
Path Finder

You are going to get a lot of fields in your outputlookup that you may not really need. You might consider adding a fields command to just put what you want in the lookup.

Alternatively, you may consider using a subsearch in your "other query" and skip the lookup altogether,

0 Karma

jip31
Motivator

yes you are right I need to add | fields a, b, c...

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes, that is workable.

Whether or not it is the perfect solution would depend on a number of things. (You can use outputlookup or outputcsv, and they have slightly different effects and destinations, but either will work.)

In any case, I've done that myself at several companies and it works just fine.

0 Karma

jip31
Motivator

thanks
I am going to check the difference between outputlookup or outputcsv

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...