lookup table field update

raomu — Tue, 23 Jan 2018 07:35:32 GMT

Hello,

I have a lookup with 3 fields "Hostname" "IP" "Status" ( Status is by default set with the value "Non-Active")

Hostname IP Status
AA 10.x.x.x Non-Active

BB 10.x.x.x Non-Active

CC 10.x.x.x Non-Active

Now I did a search using lookup to find what all servers are currently reporting to Splunk :

Result :

Host reporting to Spunk

Based on the result I want to update the value of field (Status as "Active") in existing lookup

So the result I am expecting :

lookup table looks now :

Hostname IP Status
AA 10.x.x.x Active

BB 10.x.x.x Non-Active

CC 10.x.x.x Active

Re: lookup table field update

valiquet — Fri, 09 Mar 2018 11:51:51 GMT

|eval Status=Active | join type=left [|inputlookup table] |outputlookup