I have a saved search that generates a table of users each day:
search "my users" | table username, id
I want to turn this search into a lookup file (users.csv) in my app on a daily basis. Each time the search runs it will overwrite data in lookup containing only results from latest search.
I know outputcsv can create a lookup file, but it there anyway to set the destination to my apps lookup directory?
Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:
search "my users" | table username, id | outputlookup users
where users is the name of your lookup table definition.
outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk
search "my users" | table username, id | outputcsv users
output would be $SPLUNK_HOME/var/run/splunk/users.csv
View solution in original post
Yes. Looking back this is a silly question. I was confusing every command with OUTPUT 🙂 It was a long day!
Yes, the outputlookup command creates the csv file in the app directory by default:
search "my users" | table username, id | outputlookup users.csv