I have a transforms as follows which defines a lookup
[ABC] filename = ABC.csv case_sensitive_match = false
Now, I am writing a saved search which updates the above lookup after executing the search.
now, which among the below should I need to specify at the end of saved search and why?
| outputlookup ABC
| outputlookup ABC.csv
Either works. If you have multiple
Lookup Definitions referencing the same
Lookup File, then I would use the
Lookup File; if it is one-to-one, then I would use the
Lookup Definition so that people understand that there is one.
Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.
Hope this helps, Thanks!