Splunk Search

splunk

Siddharthnegi
Contributor

How to create empty.csv lookup in web

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

No you can't. Excels xlsx file's format is something else than ASCII/UTF-8 text with separator. It's somekind of XML file.

If you want to use files from Excel you should export those to CSV before use. Then you can use that CSV file.

On splunkbase there seems to be app https://splunkbase.splunk.com/app/6969. Unfortunately it seems to be licensed or something similar as it's not freely downloable. Also it just export data to excel not read from excel, if I have understood right.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

here is the simplest way

| makeresults
| search foo
| outputlookup foo.csv

 

Basically you should create "empty" resultset and then forward it to outputlookup command.

r. Ismo 

Siddharthnegi
Contributor

Siddharthnegi_0-1693548364652.png

can i use xlsx file . here

0 Karma

isoutamo
SplunkTrust
SplunkTrust

No you can't. Excels xlsx file's format is something else than ASCII/UTF-8 text with separator. It's somekind of XML file.

If you want to use files from Excel you should export those to CSV before use. Then you can use that CSV file.

On splunkbase there seems to be app https://splunkbase.splunk.com/app/6969. Unfortunately it seems to be licensed or something similar as it's not freely downloable. Also it just export data to excel not read from excel, if I have understood right.

gcusello
SplunkTrust
SplunkTrust

Hi @Siddharthnegi ,

in addition, remember to create a lookup definition [Settings > Lookups > Lookup Definition] otherwise you cannot fully use the lookup.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...