syntax for outputlookup when defined in transforms.conf?

[pavanae]

I have a transforms as follows which defines a lookup

[ABC]
filename = ABC.csv
case_sensitive_match = false

Now, I am writing a saved search which updates the above lookup after executing the search.

now, which among the below should I need to specify at the end of saved search and why?

| outputlookup ABC

OR

| outputlookup ABC.csv

[woodcock]

Either works. If you have multiple Lookup Definitions referencing the same Lookup File, then I would use the Lookup File; if it is one-to-one, then I would use the Lookup Definition so that people understand that there is one.

[sandeepmakkena]

Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.

Hope this helps, Thanks!

[starcher · Accepted solution]

You can use either. But it is good form to only use the transform definition name.

[pavanae]

thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?

My_Search | | outputlookup ABC

[woodcock]

That is correct.