topic Re: Can we delete the data from lookup file created ?? in Getting Data In

Can we delete the data from lookup file created ??

rakesh_498115 — Wed, 12 Dec 2012 15:22:30 GMT

Hi..

I have written a shceduled search which will save my data to a csv file..Is ther any query to delete the data from csv file after a certain period if needed ??

Please help..

Re: Can we delete the data from lookup file created ??

yannK — Wed, 12 Dec 2012 15:33:55 GMT

You can have a scheduled search that will overwrite the lookup with empty events on a regular basis.

Re: Can we delete the data from lookup file created ??

rakesh_498115 — Wed, 12 Dec 2012 16:54:28 GMT

Can you give a sample query pls ??

Re: Can we delete the data from lookup file created ??

yannK — Wed, 12 Dec 2012 17:00:02 GMT

from a saved search in the same app than the lookup :

* | head 1 | eval _raw="" | table _raw | outputlookup <nameofthelookupcsvfile>

Re: Can we delete the data from lookup file created ??

rakesh_498115 — Thu, 13 Dec 2012 18:52:03 GMT

its deleting all the data..i need the last row to be deleted on daily basis...after creating says 30 rows..how can i do it ?

Re: Can we delete the data from lookup file created ??

yannK — Thu, 13 Dec 2012 19:05:50 GMT

input the data from the existing lookup (inputlookup)
process the data, remove lines, add new lines
output the data to the lookup (outputlookup)

Re: Can we delete the data from lookup file created ??

rakesh_498115 — Thu, 13 Dec 2012 20:05:58 GMT

Can you pls give the search query for that ?? say my lookup file Data.csv .. each time i need to delete the last record on the daily basis...how can i do it ??

Re: Can we delete the data from lookup file created ??

yannK — Thu, 13 Dec 2012 20:10:36 GMT

let's suppose your lookup contains 3 columns (3 fields)

| inputlookup  
| where (whatever condition to remove or keep lines)
| eval (whatever transforms rules you need )
| append [ search sub search to generate new results to add  if any | table field1 field2 field3 ]  
| table field1 field2 field3 
| outputlookup

Re: Can we delete the data from lookup file created ??

rakesh_498115 — Thu, 13 Dec 2012 20:18:30 GMT

Hi.Yannk that was real quick...can you please give me the extact query..i need to the remove the last record from csv file on daily basis...and i want the add the new records from the top to the existing ones..

Re: Can we delete the data from lookup file created ??

rakesh_498115 — Thu, 13 Dec 2012 20:21:56 GMT

can i delte the last record based on the condition .i.e records count is greater then 30...

Re: Can we delete the data from lookup file created ??

hardik_d — Tue, 13 Jul 2021 10:36:16 GMT

If you don't know no. of rows in csv file then execute below two queries to delete last row in csv lookup

| inputlookup <lookup_name> | stats count

Now, use the count value in below query::

| inputlookup <lookup_name> | head count-1 | outputlookup <lookup_name>

Re: Can we delete the data from lookup file created ??

rahmatn — Fri, 18 Mar 2022 04:05:56 GMT

this work for me, you may try

| inputlookup <lookup_name> | head count=1 | outputlookup <lookup_name>