scheduled update of a lookup file.

[daktapaal]

Dear Splunkers.
I have a form, where I am loading a drop down, using a lookup file, that searches the top products. I am using.

><![CDATA[|inputlookup top-products.csv]]>

The top-products.csv is a result of outputting the search results of the top products. <!--
index = "ssh" | dedup product | table product | outputlookup products-table.csv
called as Search-Product-->

I then use one of the products selected in the drop down for creating a search string. All works fine. I now need to make sure I always get the correct and updated set of products in the drop down. This probably requires me to run the search " Search-Product" above, regularly like every day, so that I can get the updated results every day..

Is there a way to schedule a search like :
index = "ssh" | dedup product | table product | outputlookup products-table.csv

on a daily basis or hourly basis?

Dak

[aholzer · Accepted solution]

Yes. Save your search. Go to Manager > saved searches > edit the saved search related to this. Click the check box labeled "schedule this search", and it'll expand all the options you have available for scheduling a search to run automatically.

Hope this helps.

[Ayn]

Converted your answering comment to a proper answer, again.