https://community.splunk.com/t5/Getting-Data-In/Append-and-Update-the-CSV-from-a-search-output/m-p/502457#M85598 <P>Hello,</P> <P>I have a search which gives the output of the fields a and b. I am saving those outputs to a csv lets say output.csv. I would like to update with the latest value of the value a and b which means I do not want old/duplicate values for a and b and append non-existing values to the CSV file . I tried to do it with the left join but I was not successful. </P> <P>Example: from the search fields below output is populated and writen to the csv.</P> <H2>name - age</H2> <P>bob 23<BR /> joey 33</P> <P>and from another search fields below output is populated </P> <H2>name - age</H2> <P>joey 43</P> <P>So I want my output.csv files to become below format.</P> <H2>name - age</H2> <P>bob 23<BR /> joey 43</P> <P>Any help?</P> <P>Bests!</P> Mon, 23 Mar 2020 14:48:33 GMT gozdeyildiz 2020-03-23T14:48:33Z https://community.splunk.com/t5/Getting-Data-In/Append-and-Update-the-CSV-from-a-search-output/m-p/502457#M85598 <P>Hello,</P> <P>I have a search which gives the output of the fields a and b. I am saving those outputs to a csv lets say output.csv. I would like to update with the latest value of the value a and b which means I do not want old/duplicate values for a and b and append non-existing values to the CSV file . I tried to do it with the left join but I was not successful. </P> <P>Example: from the search fields below output is populated and writen to the csv.</P> <H2>name - age</H2> <P>bob 23<BR /> joey 33</P> <P>and from another search fields below output is populated </P> <H2>name - age</H2> <P>joey 43</P> <P>So I want my output.csv files to become below format.</P> <H2>name - age</H2> <P>bob 23<BR /> joey 43</P> <P>Any help?</P> <P>Bests!</P> Mon, 23 Mar 2020 14:48:33 GMT https://community.splunk.com/t5/Getting-Data-In/Append-and-Update-the-CSV-from-a-search-output/m-p/502457#M85598 gozdeyildiz 2020-03-23T14:48:33Z https://community.splunk.com/t5/Getting-Data-In/Append-and-Update-the-CSV-from-a-search-output/m-p/502458#M85599 <P>CSV files must be updated in their entirety. The usual method is to read in the CSV, append the results of a search, deduplicate the results, and write them to the CSV.</P> <PRE><CODE>| inputlookup output.csv | append [ &lt;your search&gt; ] | dedup name | outputlookup outputs.csv </CODE></PRE> Mon, 23 Mar 2020 17:45:04 GMT https://community.splunk.com/t5/Getting-Data-In/Append-and-Update-the-CSV-from-a-search-output/m-p/502458#M85599 richgalloway 2020-03-23T17:45:04Z