https://community.splunk.com/t5/Getting-Data-In/Lookup-row-delete/m-p/573262#M101409 <P>Hi,</P><P>I've added a new row to an existing lookup file for testing the query and now I need to delete the last couple of rows to retain it to its original form. Is that possible, and if yes, please give me a solution!!!</P><P>&nbsp;</P><P>Thanks in advance!</P><P>&nbsp;</P> Tue, 02 Nov 2021 05:37:05 GMT Raghul_S 2021-11-02T05:37:05Z https://community.splunk.com/t5/Getting-Data-In/Lookup-row-delete/m-p/573262#M101409 <P>Hi,</P><P>I've added a new row to an existing lookup file for testing the query and now I need to delete the last couple of rows to retain it to its original form. Is that possible, and if yes, please give me a solution!!!</P><P>&nbsp;</P><P>Thanks in advance!</P><P>&nbsp;</P> Tue, 02 Nov 2021 05:37:05 GMT https://community.splunk.com/t5/Getting-Data-In/Lookup-row-delete/m-p/573262#M101409 Raghul_S 2021-11-02T05:37:05Z https://community.splunk.com/t5/Getting-Data-In/Lookup-row-delete/m-p/573265#M101411 <P>Read the whole lookup in (inputlookup), remove the unwanted events (with a where command or somesuch), then write the whole lookup (outputlookup append=f)</P> Tue, 02 Nov 2021 06:28:52 GMT https://community.splunk.com/t5/Getting-Data-In/Lookup-row-delete/m-p/573265#M101411 ITWhisperer 2021-11-02T06:28:52Z