Splunk Search

splunk

Siddharthnegi
Contributor

How to create empty.csv lookup in web

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

No you can't. Excels xlsx file's format is something else than ASCII/UTF-8 text with separator. It's somekind of XML file.

If you want to use files from Excel you should export those to CSV before use. Then you can use that CSV file.

On splunkbase there seems to be app https://splunkbase.splunk.com/app/6969. Unfortunately it seems to be licensed or something similar as it's not freely downloable. Also it just export data to excel not read from excel, if I have understood right.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

here is the simplest way

| makeresults
| search foo
| outputlookup foo.csv

 

Basically you should create "empty" resultset and then forward it to outputlookup command.

r. Ismo 

Siddharthnegi
Contributor

Siddharthnegi_0-1693548364652.png

can i use xlsx file . here

0 Karma

isoutamo
SplunkTrust
SplunkTrust

No you can't. Excels xlsx file's format is something else than ASCII/UTF-8 text with separator. It's somekind of XML file.

If you want to use files from Excel you should export those to CSV before use. Then you can use that CSV file.

On splunkbase there seems to be app https://splunkbase.splunk.com/app/6969. Unfortunately it seems to be licensed or something similar as it's not freely downloable. Also it just export data to excel not read from excel, if I have understood right.

gcusello
SplunkTrust
SplunkTrust

Hi @Siddharthnegi ,

in addition, remember to create a lookup definition [Settings > Lookups > Lookup Definition] otherwise you cannot fully use the lookup.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...