Splunk Search

output lookup to /app/lookups

Contributor

I have a saved search that generates a table of users each day:

search "my users" | table username, id

I want to turn this search into a lookup file (users.csv) in my app on a daily basis. Each time the search runs it will overwrite data in lookup containing only results from latest search.

I know outputcsv can create a lookup file, but it there anyway to set the destination to my apps lookup directory?

0 Karma
1 Solution

Ultra Champion

Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:

search "my users" | table username, id | outputlookup users 

where users is the name of your lookup table definition.

outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk

 search "my users" | table username, id | outputcsv users

output would be $SPLUNK_HOME/var/run/splunk/users.csv

View solution in original post

0 Karma

Ultra Champion

Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:

search "my users" | table username, id | outputlookup users 

where users is the name of your lookup table definition.

outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk

 search "my users" | table username, id | outputcsv users

output would be $SPLUNK_HOME/var/run/splunk/users.csv

View solution in original post

0 Karma

Contributor

Yes. Looking back this is a silly question. I was confusing every command with OUTPUT 🙂 It was a long day!

0 Karma

Legend

Yes, the outputlookup command creates the csv file in the app directory by default:

search "my users" | table username, id | outputlookup users.csv
0 Karma