Splunk Search

syntax for outputlookup when defined in transforms.conf?

pavanae
Builder

I have a transforms as follows which defines a lookup

[ABC]
filename = ABC.csv
case_sensitive_match = false

Now, I am writing a saved search which updates the above lookup after executing the search.

now, which among the below should I need to specify at the end of saved search and why?

| outputlookup ABC

OR

| outputlookup ABC.csv
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You can use either. But it is good form to only use the transform definition name.

View solution in original post

woodcock
Esteemed Legend

Either works. If you have multiple Lookup Definitions referencing the same Lookup File, then I would use the Lookup File; if it is one-to-one, then I would use the Lookup Definition so that people understand that there is one.

0 Karma

sandeepmakkena
Contributor

Yes, Can use either way. If your results are not getting to file that might be some permission issues that are defined in transforms.conf.

Hope this helps, Thanks!

0 Karma

starcher
SplunkTrust
SplunkTrust

You can use either. But it is good form to only use the transform definition name.

View solution in original post

pavanae
Builder

thanks for the response @starcher . So when you say transform definition name it means It's better to use the below right?

My_Search | | outputlookup ABC

0 Karma

woodcock
Esteemed Legend

That is correct.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!