topic Re: How do you append new results in a lookup file? in Splunk Search

How do you append new results in a lookup file?

chanthongphiob — Tue, 13 Mar 2018 15:15:59 GMT

I have a lookup table that runs every month of previous successful logins. For example:

Account_Name, Host
alpha, comp1 comp2 comp3
bravo, comp1 comp3
charlie, comp2

Now I have a scheduled report to run daily to determine any differences between the lookup file and account names and hosts of new daily logons. So, for example, if the new data is...

Account_Name, Host
alpha, comp4
alpha, comp5
bravo, comp2
charlie, comp1

I want my new lookup table to compensate for this. New result set will be as follow:
Account_Name, Host
alpha, comp1 comp2 comp3 comp4 comp5
bravo, comp1 comp2 comp3
charlie, comp1 comp2

How do I write the outputlookup portion to append the new data to the old data in the lookup file?

My query is as follow to obtain new data:
index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host

Re: How do you append new results in a lookup file?

jameswatts — Tue, 13 Mar 2018 16:21:07 GMT

search blah | inputlookup append=true X.cvs | outputlookup X.csv

Re: How do you append new results in a lookup file?

493669 — Tue, 13 Mar 2018 16:54:32 GMT

Hi @chanthongphiob,
Try this:

index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv

Re: How do you append new results in a lookup file?

inventsekar — Mon, 23 Nov 2020 07:33:09 GMT

Are you guys sure of this method with tstats?

| tstats count where (index=test* earliest="2/1/2020:00:00:00" latest="3/1/2020:00:00:00") BY _time span=1d 
| inputlookup append=true testlookup.cvs 
| outputlookup testlookup.csv