Update only specific field in csv

AKG1_old1 — Tue, 29 Sep 2020 19:19:53 GMT

Hi,

I am running a search query which take input from lookup and generate counts for each row. And I want to update only specific column "No_Of_MXTIMING_Events" in the csv. It should't change the row count and I don't want to rewrite full csv again.

Query to generate "No_Of_MXTIMING_Events"

| inputlookup Test_Row_Count.csv | where isnull(No_TPS_Events) OR isnull(No_TPS_Events)
| eval Start_epoc=Start 
| eval Stop_epoc=Stop 
| table ID, Start_epoc , Stop_epoc, Host 
| map maxsearches=1001 search="| tstats summariesonly=true count(MXTIMING.Elapsed) as No_Of_MXTIMING_lines FROM datamodel=MXTIMING_V8 WHERE 
    host=$Host$ earliest=$Start_epoc$ latest=$Stop_epoc$  | eval ID=\"$ID$\" | eval Host=\"$Host$\" " 
| sort 0 - by ID 
| table ID, Host, No_Of_MXTIMING_lines

Re: Update only specific field in csv

xpac — Wed, 02 May 2018 09:42:31 GMT

Simply put, you can't. KV Store lookups allow to only update certain records, but CSV lookups can only be written as a whole.
You therefore have to do | inputlookup, then do your change, and then do | outputlookup so all data is written back to the lookup.

You could however replace | table in your example with | fields. The | table command is only used for graphical representation, and is considerably slower than | fields, although it has the same effect in your use case.

topic Re: Update only specific field in csv in Getting Data In

Update only specific field in csv

Re: Update only specific field in csv