Splunk Search

How to generate a lookup file with outputlookup in a specific app?

vishal_bandavad
Explorer

I am using | dbquery to get the lookup details and outputlookup to generate the lookup file, but it always generates under different app (either system/lookup or app/dbx/lookup). I am trying to run the query in a search from a different app, say SampleApp.

Please let me how I can create the lookup under SampleApp? or is there any config file I need to change or any command to move the file under a certain app?

0 Karma

sanjay_shrestha
Contributor
0 Karma

sanjay_shrestha
Contributor

Running your query to generate lookup fine under SampleApp might help.

0 Karma

vishal_bandavad
Explorer

I tried , but it is creating $SPLUNK_HOME$/etc/system/lookups/ instead of $SPLUNK_HOME$/etc/apps/SampleApp/lookups

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...