Splunk Search

syntax for outputlookup when defined in transforms.conf?

pavanae
Builder

I have a transforms as follows which defines a lookup

[ABC]
filename = ABC.csv
case_sensitive_match = false

Now, I am writing a saved search which updates the above lookup after executing the search.

now, which among the below should I need to specify at the end of saved search and why?

| outputlookup ABC

OR

| outputlookup ABC.csv
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You can use either. But it is good form to only use the transform definition name.

View solution in original post

woodcock
Esteemed Legend

Either works. If you have multiple Lookup Definitions referencing the same Lookup File, then I would use the Lookup File; if it is one-to-one, then I would use the Lookup Definition so that people understand that there is one.

0 Karma

sandeepmakkena
Contributor

Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.

Hope this helps, Thanks!

0 Karma

starcher
SplunkTrust
SplunkTrust

You can use either. But it is good form to only use the transform definition name.

View solution in original post

pavanae
Builder

thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?

My_Search | | outputlookup ABC

0 Karma

woodcock
Esteemed Legend

That is correct.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!