outputlookup
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
outputlookup
Synopsis
Writes search results to the specified static lookup table.
Syntax
outputlookup [create_empty=<bool>] [max=<int>] [createinapp=<bool>] (<filename> | <tablename>)
Required arguments
- <filename>
- Syntax: <string>
- Description: The name of the lookup file (must end with .csv or .csv.gz).
- <tablename>
- Syntax: <string>
- Description: The name of the lookup table as specified by a stanza name in transforms.conf.
Optional arguments
- max
- Syntax: max=<int>
- Description: The number of rows to output.
- create_empty
- Syntax: create_empty=<bool>
- Description: If set to true and there are no results, creates a 0-length file. When false, no file is created and the files is deleted if it previously existed. Defaults to true.
- createinapp
- Syntax: createinapp=<bool>
- Description: If set to false or if there is no current application context, then create the file in the system lookups directory.
Description
Saves results to a lookup table as specified by a filename (must end with .csv or .gz) or a table name (as specified by a stanza name in transforms.conf). If the lookup file does not exist, Splunk creates the file in the lookups directory of the current application. If the lookup file already exists, Splunk overwrites that files with the results of outputlookup. If the 'createinapp' option is set to false or if there is no current application context, then Splunk creates the file in the system lookups directory.
Examples
Example 1: Write to "usertogroup" lookup table (as specified in transforms.conf).
| outputlookup usertogroupExample 2: Write to "users.csv" lookup file (under $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups).
| outputlookup users.csvSee also
inputlookup, lookup, outputcsv
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the outputlookup command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.