splunk

[Siddharthnegi]

How to create empty.csv lookup in web

[isoutamo]

Hi

here is the simplest way

| makeresults
| search foo
| outputlookup foo.csv

Basically you should create "empty" resultset and then forward it to outputlookup command.

r. Ismo 

[Siddharthnegi]

Siddharthnegi_0-1693548364652.png

can i use xlsx file . here

[isoutamo · Accepted solution]

No you can't. Excels xlsx file's format is something else than ASCII/UTF-8 text with separator. It's somekind of XML file.

If you want to use files from Excel you should export those to CSV before use. Then you can use that CSV file.

On splunkbase there seems to be app https://splunkbase.splunk.com/app/6969. Unfortunately it seems to be licensed or something similar as it's not freely downloable. Also it just export data to excel not read from excel, if I have understood right.

[gcusello]

Hi @Siddharthnegi ,

in addition, remember to create a lookup definition [Settings > Lookups > Lookup Definition] otherwise you cannot fully use the lookup.

Ciao.

Giuseppe