Writes search results to the specified static lookup table.
outputlookup [append=<bool>] [create_empty=<bool>] [max=<int>] [createinapp=<bool>] (<filename> | <tablename>)
- Syntax: <string>
- Description: The name of the lookup file (must end with .csv or .csv.gz).
- Syntax: <string>
- Description: The name of the lookup table as specified by a stanza name in transforms.conf.
- Syntax: append=<bool>
- Description: If 'append' is true, we will attempt to append to an existing csv file if it exists or create a file if necessary. If there is an existing file that has a csv header already, we will only emit the fields that are referenced by that header. .gz files cannot be append to. Defaults to false.
- Syntax: max=<int>
- Description: The number of rows to output.
- Syntax: create_empty=<bool>
- Descriptopn: If set to true and there are no results, creates a 0-length file. When false, no file is created and the files is deleted if it previously existed. Defaults to true.
- Syntax: createinapp=<bool>
- Description: If set to false or if there is no current application context, then create the file in the system lookups directory.
Saves results to a lookup table as specified by a filename (must end with .csv or .gz) or a table name (as specified by a stanza name in transforms.conf). If the lookup file does not exist, Splunk creates the file in the lookups directory of the current application. If the lookup file already exists, Splunk overwrites that files with the results of
outputlookup. If the 'createinapp' option is set to false or if there is no current application context, then Splunk creates the file in the system lookups directory.
Example 1: Write to "usertogroup" lookup table (as specified in transforms.conf).
| outputlookup usertogroup
Example 2: Write to "users.csv" lookup file (under $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups).
| outputlookup users.csv
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the outputlookup command.