Splunk Search

syntax for outputlookup when defined in transforms.conf?

pavanae
Builder

I have a transforms as follows which defines a lookup

[ABC]
filename = ABC.csv
case_sensitive_match = false

Now, I am writing a saved search which updates the above lookup after executing the search.

now, which among the below should I need to specify at the end of saved search and why?

| outputlookup ABC

OR

| outputlookup ABC.csv
0 Karma
1 Solution

starcher
Influencer

You can use either. But it is good form to only use the transform definition name.

View solution in original post

woodcock
Esteemed Legend

Either works. If you have multiple Lookup Definitions referencing the same Lookup File, then I would use the Lookup File; if it is one-to-one, then I would use the Lookup Definition so that people understand that there is one.

0 Karma

sandeepmakkena
Contributor

Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.

Hope this helps, Thanks!

0 Karma

starcher
Influencer

You can use either. But it is good form to only use the transform definition name.

pavanae
Builder

thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?

My_Search | | outputlookup ABC

0 Karma

woodcock
Esteemed Legend

That is correct.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...