topic Re: I want to add new entry to my lookups and older values are overridden by new values. in Splunk Enterprise

How to add new entry to lookups and older values are overridden by new values?

sagar_shubham23 — Wed, 19 Apr 2023 21:21:54 GMT

Why i am getting Duplicate entries while using outputlookups.

Query:

|inputlookup append=t test1_checks.csv| eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0| outputlookup append=true test1_checks.csv

Result:

Alert Type Correlated_alert

test2 test2

I need only one entry for all kind of entries in Alert_type and Correlated_alert.

Kindly help

Re: I want to add new entry to my lookups and older values are overridden by new values.

somesoni2 — Wed, 19 Apr 2023 14:22:48 GMT

Give this a try

|inputlookup append=t test1_checks.csv | append [| makeresults | eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0 | table Alert_type Correlated_alert Correlation_type ] | stats last(Correlation_type) as Correlation_type by Alert_type Correlated_alert | outputlookup append=true test1_checks.csv

Re: I want to add new entry to my lookups and older values are overridden by new values.

richgalloway — Wed, 19 Apr 2023 14:25:19 GMT

The append=true option to outputlookup tells Splunk to keep the existing lookup file content. To replace the content with the current result set, use append=false (the default).

| inputlookup test1_checks.csv | eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0 | outputlookup test1_checks.csv

As @somesoni2 mentioned, to eliminate duplicate entries, you need to use the stats or dedup command.