<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to delete entire lookup table data in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619108#M106766</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250847"&gt;@pdafale_avantor&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;i hope i understood your question correctly: you want to recreate identities.csv every week from ldap.&amp;nbsp; You already have your ldap query, so it would be as simple as using the outputlookup command. This will create the lookup in the current app and overwrite the existing identities.csv&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;| ldapsearch domain=SPL search="(objectClass=user)" | stats something | outputlookup createinapp=t indentities.csv&lt;/LI-CODE&gt;&lt;P class=""&gt;best regards,&lt;/P&gt;&lt;P class=""&gt;Andreas&lt;/P&gt;</description>
    <pubDate>Tue, 01 Nov 2022 13:54:47 GMT</pubDate>
    <dc:creator>schose</dc:creator>
    <dc:date>2022-11-01T13:54:47Z</dc:date>
    <item>
      <title>How to delete entire lookup table data?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619097#M106765</link>
      <description>&lt;P&gt;Hello all,&lt;/P&gt;
&lt;P&gt;I have created a ldap search query to load identity data. I want all existing lookup table entries to be deleted and populate the same table with new entries obtained by scheduled search (weekly basis).&lt;BR /&gt;&lt;BR /&gt;Let's say lookup name is identities.csv. Can someone help me with the query to delete all existing lookup table entries (identities.csv).&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 02 Nov 2022 02:38:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619097#M106765</guid>
      <dc:creator>pdafale_avantor</dc:creator>
      <dc:date>2022-11-02T02:38:08Z</dc:date>
    </item>
    <item>
      <title>Re: How to delete entire lookup table data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619108#M106766</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250847"&gt;@pdafale_avantor&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;i hope i understood your question correctly: you want to recreate identities.csv every week from ldap.&amp;nbsp; You already have your ldap query, so it would be as simple as using the outputlookup command. This will create the lookup in the current app and overwrite the existing identities.csv&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;| ldapsearch domain=SPL search="(objectClass=user)" | stats something | outputlookup createinapp=t indentities.csv&lt;/LI-CODE&gt;&lt;P class=""&gt;best regards,&lt;/P&gt;&lt;P class=""&gt;Andreas&lt;/P&gt;</description>
      <pubDate>Tue, 01 Nov 2022 13:54:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619108#M106766</guid>
      <dc:creator>schose</dc:creator>
      <dc:date>2022-11-01T13:54:47Z</dc:date>
    </item>
    <item>
      <title>Re: How to delete entire lookup table data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619116#M106767</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/194518"&gt;@schose&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks for the inputs. Yes exactly, I&amp;nbsp;&lt;SPAN&gt;want to recreate identities.csv every week from ldap search query. I already have ldap search query which is correctly populating identities.csv as below. Please confirm if it shall work (recreate new data and remove all old entries) :-&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;|ldapsearch domain=DOMAIN_NAME
search="(&amp;amp;(objectclass=user)(!(objectClass=computer)))"
attrs="sAMAccountName,personalTitle,displayName,givenName,sn,mail,telephoneNumber,mobile,manager,department,whenCreated,userAccountControl"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate=""
|table
sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate | outputlookup createinapp=t indentities.csv&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I am planning to run it as a scheduled search.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Regards,&lt;/P&gt;&lt;P&gt;Prathamesh&lt;/P&gt;</description>
      <pubDate>Tue, 01 Nov 2022 14:32:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619116#M106767</guid>
      <dc:creator>pdafale_avantor</dc:creator>
      <dc:date>2022-11-01T14:32:31Z</dc:date>
    </item>
    <item>
      <title>Re: How to delete entire lookup table data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619160#M106771</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;SPAN&gt;Prathamesh,&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;yes, this should work..&amp;nbsp;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;regards,&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Andreas&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 01 Nov 2022 16:32:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-delete-entire-lookup-table-data/m-p/619160#M106771</guid>
      <dc:creator>schose</dc:creator>
      <dc:date>2022-11-01T16:32:44Z</dc:date>
    </item>
  </channel>
</rss>

