Splunk Search

dbquery and outputlookup

HeinzWaescher
Motivator

Hello,

I'm running a dbquery and would like to save the results as a lookuptable.csv.

| dbquery mysearch | outputlookup lookuptable.csv

After running the search this works:

| inputlookup lookuptable.csv

But I can't find the file in the settings to adjust the permissions, delete the file or something else. What am I doing wrong?

BR

Heinz

0 Karma

linu1988
Champion

Hello Heinz,
When you do outputlookup the file goes to system dir in the splunk etc dir. The inputlookup sees the file in your app/lookup folder in the app context. Everything is correct what you are doing , you need some more param.

your desierd query:

| dbquery mysearch | outputlookup createinapp=true lookuptable.csv

then try the inputlookup

createinapp
Syntax: createinapp=<bool>
Description: If set to false or if there is no current application context, then create the file in the system lookups directory.

See the documentation :
http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Outputlookup

Thanks,
L

linu1988
Champion

do you the see the new outputlookup file in the lookup directory?

0 Karma

HeinzWaescher
Motivator

Yes, that's the way I check for my lookups usually. And usually they appear in the app I'm running the search...

0 Karma

linu1988
Champion

where do you check for the file?

Manager » Lookups » Lookup table files

Choose the application under which you are running the search. lookuptable.csv with full path will be mentioned

0 Karma

HeinzWaescher
Motivator

Hi,

thanks for your answers. I've always used the command without the createinapp param and everything appeared in the settings...

In this case I tried out createinapp=true, but unfortunately it does not solve the problem. It still doesn't appear in my settings.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...