https://community.splunk.com/t5/Getting-Data-In/pushing-data-to-new-csv/m-p/460000#M79409 <P>Hikavyamohan,<BR /> you have a continuous monitoring, so the new row is read and indexed by Splunk, to add this row to your csv you have two choices:</P> <UL> <LI>override the csv with all the results of your search,</LI> <LI>add only the new row.</LI> </UL> <P>The first choice is the easiest because you have to run your search and use the command outputlookup at the end (see <A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Outputlookup">https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Outputlookup</A> ).</P> <P>The second requires that you filter the results of your search using the existing csv.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 14 Oct 2019 11:23:01 GMT gcusello 2019-10-14T11:23:01Z https://community.splunk.com/t5/Getting-Data-In/pushing-data-to-new-csv/m-p/459999#M79408 <P>I have a csv where there are 5 columns and the number of rows is 1000. I have indexed that csv as continuous monitoring. If a new row is added into the same csv it should be automatically pushed to new csv which I have created in Splunk. this can be done based on the any calculation. Is this possible?</P> Mon, 14 Oct 2019 10:39:29 GMT https://community.splunk.com/t5/Getting-Data-In/pushing-data-to-new-csv/m-p/459999#M79408 kavyamohan 2019-10-14T10:39:29Z https://community.splunk.com/t5/Getting-Data-In/pushing-data-to-new-csv/m-p/460000#M79409 <P>Hikavyamohan,<BR /> you have a continuous monitoring, so the new row is read and indexed by Splunk, to add this row to your csv you have two choices:</P> <UL> <LI>override the csv with all the results of your search,</LI> <LI>add only the new row.</LI> </UL> <P>The first choice is the easiest because you have to run your search and use the command outputlookup at the end (see <A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Outputlookup">https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Outputlookup</A> ).</P> <P>The second requires that you filter the results of your search using the existing csv.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 14 Oct 2019 11:23:01 GMT https://community.splunk.com/t5/Getting-Data-In/pushing-data-to-new-csv/m-p/460000#M79409 gcusello 2019-10-14T11:23:01Z