Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- output lookup to /app/lookups
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a saved search that generates a table of users each day:
search "my users" | table username, id
I want to turn this search into a lookup file (users.csv) in my app on a daily basis. Each time the search runs it will overwrite data in lookup containing only results from latest search.
I know outputcsv can create a lookup file, but it there anyway to set the destination to my apps lookup directory?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:
search "my users" | table username, id | outputlookup users
where users is the name of your lookup table definition.
outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk
search "my users" | table username, id | outputcsv users
output would be $SPLUNK_HOME/var/run/splunk/users.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you confusing outlputlookup with outputcsv?
The former will use your transforms.conf and write to your apps ./lookups/users.csv
The command for which would be:
search "my users" | table username, id | outputlookup users
where users is the name of your lookup table definition.
outputcsv on the other hand will write the file to $SPLUNK_HOME/var/run/splunk
search "my users" | table username, id | outputcsv users
output would be $SPLUNK_HOME/var/run/splunk/users.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. Looking back this is a silly question. I was confusing every command with OUTPUT 🙂 It was a long day!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, the outputlookup command creates the csv file in the app directory by default:
search "my users" | table username, id | outputlookup users.csv
Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
