topic Re: ingesting data in lookup in Splunk Enterprise

How to search ingesting data in lookup?

smanojkumar — Tue, 21 Jun 2022 15:57:14 GMT

I would like to know about to add a single field value to outputlookup, as currently there are some fields like id, condition, value is there , but the need is only to ingest condition, Can anyone provide the query for this.

Re: ingesting data in lookup

richgalloway — Fri, 17 Jun 2022 20:13:18 GMT

The inputlookup command does have a way to specify which field(s) to return. You can, however, use the fields command for that.

| inputlookup mylookup.csv | fields condition

Re: ingesting data in lookup

smanojkumar — Sat, 18 Jun 2022 02:34:47 GMT

Hi @richgalloway ,

It is kind of storing data in lookup, so for storing data in lookup that should be one field, so that i mentioned outputlookup.

Re: ingesting data in lookup

marysan — Sat, 18 Jun 2022 06:32:24 GMT

inputlookup mylookup.csv
|fields condition
|outputlookup mylookup.csv (OR outputlookup mylookup2.csv)

Re: ingesting data in lookup

richgalloway — Sat, 18 Jun 2022 17:15:41 GMT

Thank for that. You also mentioned "ingest" twice so no wonder I mis-understood.

Lookup files must be updated in their entirety. You cannot replace a single row or field. @marysan has the right answer for replacing the entire lookup with a single column.

To be able to updated individual fields in a lookup, use a KVStore collection.

Re: ingesting data in lookup

marysan — Sun, 19 Jun 2022 05:04:05 GMT

there is some ways to update just one field in a lookup
for example we have a lookup with (IP,reported) fields
if you want to change reported field from 0 to 1 just for a specific IP,for example IP:1.2.3.4 , and you dont want to change other values :
|inputlookup mylookup.csv
|eval reported=if(IP="1.2.3.4",0,reported)
|outputlookup mylookup.csv

Re: ingesting data in lookup

richgalloway — Sun, 19 Jun 2022 14:02:28 GMT

That is the method for updating a lookup file, but to be clear, the outputlookup command rewrites the entire lookup even if only a single bit is different.