topic Re: Populating Lookup using saved search in Reporting

Populating Lookup using saved search

akshatj2 — Thu, 01 Aug 2019 21:24:52 GMT

Hi All,

I would like to populate a lookup using savedsearches but condition being the previous entry from the lookup should only be removed if the current search result returns some values. In case the search does not return any value. the lookup should not be changed.

Can anyone help me with the possible solution for the same.

Re: Populating Lookup using saved search

richgalloway — Thu, 01 Aug 2019 22:46:00 GMT

Do your search then read the existing lookup file using the append=true option. Deduplicate the results and write them back to the lookup file.

Re: Populating Lookup using saved search

akshatj2 — Thu, 01 Aug 2019 23:34:44 GMT

No, it just search for the events and write it to lookup. We do not append data as it will become very huge with time going forward

Re: Populating Lookup using saved search

nareshinsvu — Wed, 30 Sep 2020 01:33:40 GMT

Hope this works. Give a Try

First command:

|from datamodel:"blahblah"| table "your column" | outputlookup your_lookup.csv

Next command: appends only if it finds additional rows in the output

Re: Populating Lookup using saved search

akshatj2 — Fri, 02 Aug 2019 09:14:05 GMT

We don't want to append the data to any of the old lookup, it should be a new lookup created when the search returns any results.

Re: Populating Lookup using saved search

richgalloway — Fri, 02 Aug 2019 13:21:10 GMT

Have a look at the create_empty and override_if_empty options of the outputlookup command to see if they satisfy your requirements.

Re: Populating Lookup using saved search

nareshinsvu — Wed, 30 Sep 2020 01:38:18 GMT

So, you can use a new name in your command? But this will create numerous lookup files and very hard for you to manage/housekeep. Mate - what is your exact requirement?