Splunk® Enterprise

Search Reference

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

outputlookup

Synopsis

Writes search results to the specified static lookup table or KV store collection.

Syntax

outputlookup [append=<bool>] [create_empty=<bool>] [max=<int>] [key_field=<field_name>] [createinapp=<bool>] (<filename> | <tablename>)

Required arguments

<filename>
Syntax: <string>
Description: The name of the lookup file. The file must end with .csv or .csv.gz.
<tablename>
Syntax: <string>
Description: The name of the lookup table as specified by a stanza name in transforms.conf. The lookup table can be configured for any lookup type (CSV, external, or KV store).

Optional arguments

append
Syntax: append=<bool>
Description: If set to true, outputlookup attempts to append search results to an existing .csv file or KV store collection. Otherwise it creates a file. If there is an existing .csv file outputlookup only writes the fields that are present in the previously existing .csv file. An outputlookup search run with append=true may result in a situation where the lookup table or collection is only partially updated at some times. This means that a subsequent lookup or inputlookup search on that collection may return stale data along with new data. outputlookup cannot append to .gz files. Defaults to false.
create_empty
Syntax: create_empty=<bool>
Description: If set to true and there are no results, creates a 0-length file. When false, no file is created and the files is deleted if it previously existed. Defaults to true.
createinapp
Syntax: createinapp=<bool>
Description: If set to false or if there is no current application context, then create the file in the system lookups directory. Defaults to true.
key_field
Syntax: key_field=<field_name>
Description: For KV store-based lookups, uses the specified field name as the key to a value and replaces that value. An outputlookup search using the key_field argument may result in a situation where the lookup table or collection is only partially updated at some times. This means that a subsequent lookup or inputlookup search on that collection may return stale data along with new data.
max
Syntax: max=<int>
Description: The number of rows to output. Defaults to no limit.

Description

Saves results to a lookup table as specified by a filename (must end with .csv or .gz) or a table name as specified by a lookup table configuration in transforms.conf. The lookup table can refer to a KV store collection or a CSV lookup. The outputlookup command cannot be used with external lookups.

For CSV-based lookups, if the lookup file does not exist, Splunk Enterprise creates it in the lookups directory of the current application. If the lookup file already exists, Splunk Enterprise overwrites that file with the results of outputlookup.

If the createinapp option is set to false or if there is no current application context, then Splunk Enterprise creates the file in the system lookups directory.

For more information about lookup table configuration, see "Configure CSV and external lookups" and "Configure KV store lookups" in the Knowledge Manager Manual.

For more information about App Key Value Store collections, see "About KV store" in the Admin Manual.

Examples

Example 1: Write to usertogroup lookup table as specified in transforms.conf.

| outputlookup usertogroup

Example 2: Write to users.csv lookup file under $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups.

| outputlookup users.csv

Example 3: Write food inspection events for Shalimar Restaurant to a KV store collection called kvstorecoll. This collection is referenced in a lookup table called kvstorecoll_lookup.

index=sf_food_health sourcetype=sf_food_inspections name="SHALIMAR RESTAURANT" | outputlookup kvstorecoll_lookup

Example 4: Write the contents of a CSV file to the KV store collection kvstorecoll using the lookup table kvstorecoll_lookup. This requires usage of both inputlookup and outputlookup.

| inputlookup customers.csv | outputlookup kvstorecoll_lookup

Example 5: Update field values for a single KV store collection record. This requires usage of inputlookup, outputlookup, and eval. The record is indicated by the value of its internal key ID (the _key field) and is updated with a new customer name and customer city. The record belongs to the KV store collection kvstorecoll, which is accessed through the lookup table kvstorecoll_lookup.

| inputlookup kvstorecoll_lookup | search _key=544948df3ec32d7a4c1d9755 | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup kvstorecoll_lookup append=True

To learn how to obtain the internal key ID values of the records in a KV store collection, see Example 5 for the inputlookup command.

See also

inputlookup, lookup, inputcsv, outputcsv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the outputlookup command.

PREVIOUS
outputcsv
  NEXT
outputtext

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters