For your use case, this configuration appears to be available from within the limits.conf file: https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Boutputlookup.5D   [outputlookup] create_context = user   per the documentation: [outputlookup] create_context = [app|[user|system] * Specifies the context where the lookup file will be created for the first time. If there is a current application context and the following options, file will be created under: * app  : etc/apps/<app>/lookups * user  : etc/users/<user>/<app>/lookups Otherwise, file will be created under: * system : etc/system/local/lookups * Default: app   ... View more