Splunk Search

lookuptable folder

Federica_92
Communicator

Hi to everyone, I have a quick question.
Using the splunk framework I have create different query that produce lookuptable, a few of these are stored in search/lookups, other are stored in mynewapp/lookups, how can I say to my splunk framework to store all the lookuptable in the search/lookups folder?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Run the search creating the lookup from the namespace of the search app.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Run the search creating the lookup from the namespace of the search app.

0 Karma

Federica_92
Communicator

Yes, the answer was " If the file doesn't exist, splunk create it in the app folder" Thank you

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

Federica_92
Communicator

yes, but I have need to create the lookup file from the app

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...