Hi ,
How to avoid .csv extension while i am mentioning lookupfile name in outputlookup
Ex : ..search | outputlookup mylookup.csv
In need lokkupfile name as mylookup
In transforms.conf just define something like
[mylookup]
filename = mylookup.csv
then you can just search with search | outputlookup mylookup
You will need to restart splunk for this change to take effect