https://community.splunk.com/t5/Getting-Data-In/How-to-update-CSV/m-p/264585#M50813 <P>Hi all,</P> <P>I am looking to have a csv with a number of rows and columns. I would like that when the CSV gets updated e.g. with new field that the query is run and then the output is put into a new column field (status) in that row to be changed to e.g. status "Detected" </P> <P>Does this make sense ? Has anyone the 1,2,3 steps please? thanks in advance. </P> Fri, 02 Sep 2016 11:14:22 GMT colinmchugo 2016-09-02T11:14:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-update-CSV/m-p/264585#M50813 <P>Hi all,</P> <P>I am looking to have a csv with a number of rows and columns. I would like that when the CSV gets updated e.g. with new field that the query is run and then the output is put into a new column field (status) in that row to be changed to e.g. status "Detected" </P> <P>Does this make sense ? Has anyone the 1,2,3 steps please? thanks in advance. </P> Fri, 02 Sep 2016 11:14:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-update-CSV/m-p/264585#M50813 colinmchugo 2016-09-02T11:14:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-update-CSV/m-p/264586#M50814 <P>Hi colinmchugo, the basic process of updating a CSV based lookup is to '| inputlookup' the CSV in question, modify the values as desired with eval and other searchtime field manipulating commands, and then '| outputlookup' back to the same CSV to commit the changes.</P> <P>If you'd like to have more featureful datastore, you can utilize KVStore collections <A href="http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZK">http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZK</A></P> <P>This allows for direct update of specific fields, without rewriting the whole lookup.</P> <P>Please let me know if this answers your question!</P> Fri, 02 Sep 2016 12:31:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-update-CSV/m-p/264586#M50814 muebel 2016-09-02T12:31:52Z