You can modify an existing saved search via a configuration file to populate a lookup table by adding the following code to the search stanza in any of your savedsearches.conf files:
action.populate_lookup = 1action.populate_lookup.dest = <string>
The <string> value can either be the path to a *.csv file or the name of an existing lookup table definition in the transforms.conf file.
Alternatively, you can also just use the Splunk GUI and amend the saved search to include the outputlookup command and required parameters.
