Splunk Search

How to update the lookup table before the scheduled search runs so it gives all lookup entries?

Nam7Splnk
Explorer

I have scheduled search that periodically updates lookup table CSV file every 15 minutes. I updated this lookup with below search query before scheduled search runs.

| inputlookup lookuptable1 | outputlookup lookuptable2 append=true 

I am able to see lookup table entries until the next time for the scheduled search but once scheduled search runs, all my new lookup entries from above search are gone.

I tried this on Standalone Search Head as well as SH cluster and the behavior is the same.

Any idea how to update this lookup table?

0 Karma
1 Solution

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

View solution in original post

0 Karma

Nam7Splnk
Explorer

Never mind. i found issue. there was dedup condition on one field and i forgot to specify
so every time when scheduled search ran, wiped out new fields with same (empty) value.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...