I have a transforms as follows which defines a lookup
[ABC]
filename = ABC.csv
case_sensitive_match = false
Now, I am writing a saved search which updates the above lookup after executing the search.
now, which among the below should I need to specify at the end of saved search and why?
| outputlookup ABC
OR
| outputlookup ABC.csv
You can use either. But it is good form to only use the transform definition name.
Either works. If you have multiple Lookup Definitions
referencing the same Lookup File
, then I would use the Lookup File
; if it is one-to-one, then I would use the Lookup Definition
so that people understand that there is one.
Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.
Hope this helps, Thanks!
You can use either. But it is good form to only use the transform definition name.
thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?
My_Search | | outputlookup ABC
That is correct.