Splunk Search

syntax for outputlookup when defined in transforms.conf?

pavanae
Builder

I have a transforms as follows which defines a lookup

[ABC]
filename = ABC.csv
case_sensitive_match = false

Now, I am writing a saved search which updates the above lookup after executing the search.

now, which among the below should I need to specify at the end of saved search and why?

| outputlookup ABC

OR

| outputlookup ABC.csv
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You can use either. But it is good form to only use the transform definition name.

View solution in original post

woodcock
Esteemed Legend

Either works. If you have multiple Lookup Definitions referencing the same Lookup File, then I would use the Lookup File; if it is one-to-one, then I would use the Lookup Definition so that people understand that there is one.

0 Karma

sandeepmakkena
Contributor

Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.

Hope this helps, Thanks!

0 Karma

starcher
SplunkTrust
SplunkTrust

You can use either. But it is good form to only use the transform definition name.

pavanae
Builder

thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?

My_Search | | outputlookup ABC

0 Karma

woodcock
Esteemed Legend

That is correct.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...