Splunk Search

output lookup to /app/lookups

himynamesdave
Contributor

I have a saved search that generates a table of users each day:

search "my users" | table username, id

I want to turn this search into a lookup file (users.csv) in my app on a daily basis. Each time the search runs it will overwrite data in lookup containing only results from latest search.

I know outputcsv can create a lookup file, but it there anyway to set the destination to my apps lookup directory?

0 Karma
1 Solution

nickhills
Ultra Champion

Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:

search "my users" | table username, id | outputlookup users 

where users is the name of your lookup table definition.

outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk

 search "my users" | table username, id | outputcsv users

output would be $SPLUNK_HOME/var/run/splunk/users.csv

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:

search "my users" | table username, id | outputlookup users 

where users is the name of your lookup table definition.

outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk

 search "my users" | table username, id | outputcsv users

output would be $SPLUNK_HOME/var/run/splunk/users.csv

If my comment helps, please give it a thumbs up!
0 Karma

himynamesdave
Contributor

Yes. Looking back this is a silly question. I was confusing every command with OUTPUT 🙂 It was a long day!

0 Karma

lguinn2
Legend

Yes, the outputlookup command creates the csv file in the app directory by default:

search "my users" | table username, id | outputlookup users.csv
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...