Documentation > Splunk > Search Reference > outputlookup

Search Reference

 


Introduction
Search Reference Overview
Search Commands and Functions
Search Command Reference
Internal Search Commands
Search in the CLI

outputlookup

Contents

outputlookup

Synopsis

Writes search results to the specified static lookup table.

Syntax

outputlookup [append=<bool>] [create_empty=<bool>] [max=<int>] [createinapp=<bool>] (<filename> | <tablename>)

Required arguments

<filename>
Syntax: <string>
Description: The name of the lookup file (must end with .csv or .csv.gz).
<tablename>
Syntax: <string>
Description: The name of the lookup table as specified by a stanza name in transforms.conf.

Optional arguments

append
Syntax: append=<bool>
Description: If 'append' is true, we will attempt to append to an existing csv file if it exists or create a file if necessary. If there is an existing file that has a csv header already, we will only emit the fields that are referenced by that header. .gz files cannot be append to. Defaults to false.
max
Syntax: max=<int>
Description: The number of rows to output.
create_empty
Syntax: create_empty=<bool>
Descriptopn: If set to true and there are no results, creates a 0-length file. When false, no file is created and the files is deleted if it previously existed. Defaults to true.
createinapp
Syntax: createinapp=<bool>
Description: If set to false or if there is no current application context, then create the file in the system lookups directory.

Description

Saves results to a lookup table as specified by a filename (must end with .csv or .gz) or a table name (as specified by a stanza name in transforms.conf). If the lookup file does not exist, Splunk creates the file in the lookups directory of the current application. If the lookup file already exists, Splunk overwrites that files with the results of outputlookup. If the 'createinapp' option is set to false or if there is no current application context, then Splunk creates the file in the system lookups directory.

Examples

Example 1: Write to "usertogroup" lookup table (as specified in transforms.conf).

| outputlookup usertogroup

Example 2: Write to "users.csv" lookup file (under $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups).

| outputlookup users.csv

See also

inputlookup, lookup, outputcsv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the outputlookup command.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Outputlookup"

This documentation applies to the following versions of Splunk: 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!