Splunk Search

How to update the lookup table before the scheduled search runs so it gives all lookup entries?

Nam7Splnk
Explorer

I have scheduled search that periodically updates lookup table CSV file every 15 minutes. I updated this lookup with below search query before scheduled search runs.

| inputlookup lookuptable1 | outputlookup lookuptable2 append=true 

I am able to see lookup table entries until the next time for the scheduled search but once scheduled search runs, all my new lookup entries from above search are gone.

I tried this on Standalone Search Head as well as SH cluster and the behavior is the same.

Any idea how to update this lookup table?

0 Karma
1 Solution

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

View solution in original post

0 Karma

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...