Splunk Search

output lookup to /app/lookups

himynamesdave
Contributor

I have a saved search that generates a table of users each day:

search "my users" | table username, id

I want to turn this search into a lookup file (users.csv) in my app on a daily basis. Each time the search runs it will overwrite data in lookup containing only results from latest search.

I know outputcsv can create a lookup file, but it there anyway to set the destination to my apps lookup directory?

0 Karma
1 Solution

nickhills
Ultra Champion

Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:

search "my users" | table username, id | outputlookup users 

where users is the name of your lookup table definition.

outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk

 search "my users" | table username, id | outputcsv users

output would be $SPLUNK_HOME/var/run/splunk/users.csv

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:

search "my users" | table username, id | outputlookup users 

where users is the name of your lookup table definition.

outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk

 search "my users" | table username, id | outputcsv users

output would be $SPLUNK_HOME/var/run/splunk/users.csv

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

himynamesdave
Contributor

Yes. Looking back this is a silly question. I was confusing every command with OUTPUT 🙂 It was a long day!

0 Karma

lguinn2
Legend

Yes, the outputlookup command creates the csv file in the app directory by default:

search "my users" | table username, id | outputlookup users.csv
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.