how to transform a search into a csv file in order to query the csv instead the index

[jip31]

hello

I have done a saved search scheduled one time per day from the query below

    index=toto sourcetype="tutu" host=3154 | outputlookup test.csv

I have done an outputlookup test.csv because I need to export data in a csv file
If I am doing this does it going to save this file in the lookup table?
What I need is to save this file because I want to be able to do an | inputlookup test.csv in other query
Is it the good process please??
thanks for your help

[hunderliggur · Accepted solution]

You are going to get a lot of fields in your outputlookup that you may not really need. You might consider adding a fields command to just put what you want in the lookup.

Alternatively, you may consider using a subsearch in your "other query" and skip the lookup altogether,

[jip31]

yes you are right I need to add | fields a, b, c...

[DalJeanis]

Yes, that is workable.

Whether or not it is the perfect solution would depend on a number of things. (You can use outputlookup or outputcsv, and they have slightly different effects and destinations, but either will work.)

In any case, I've done that myself at several companies and it works just fine.

[jip31]

thanks
I am going to check the difference between outputlookup or outputcsv