I have scheduled search that periodically updates lookup table CSV file every 15 minutes. I updated this lookup with below search query before scheduled search runs.
| inputlookup lookuptable1 | outputlookup lookuptable2 append=true
I am able to see lookup table entries until the next time for the scheduled search but once scheduled search runs, all my new lookup entries from above search are gone.
I tried this on Standalone Search Head as well as SH cluster and the behavior is the same.
Any idea how to update this lookup table?
... View more