https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup.
Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup?
action.lookup = <boolean> * Specifies whether the lookup action is enabled for this search. * Default: false action.lookup.filename = <lookup filename> action.lookup.append = <boolean>
and
action.populate_lookup = <boolean> * Specifies whether the lookup population action is enabled for this search. * Default: false action.populate_lookup.dest = <string> run_on_startup = <boolean> run_n_times = <unsigned integer>
So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.
So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.