https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387849#M113136 <PRE><CODE>| inputlookup &lt;table&gt; | append [makeresults | eval .... | fields - _time] | dedup &lt;keyfield&gt; | outputlookup &lt;table&gt; append=false </CODE></PRE> Wed, 08 Aug 2018 12:52:51 GMT FritzWittwer_ol 2018-08-08T12:52:51Z https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387848#M113135 <P>Hi guys, </P> <P>I was wondering if anyone knew of a method of appending data to a lookup, but not overwriting anything in the lookup AND also not adding duplicate data entries into the lookup? </P> <P>Any suggestions would be helpful. </P> <P>Cheers,<BR /> Robbie</P> Wed, 08 Aug 2018 09:38:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387848#M113135 Robbie1194 2018-08-08T09:38:07Z https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387849#M113136 <PRE><CODE>| inputlookup &lt;table&gt; | append [makeresults | eval .... | fields - _time] | dedup &lt;keyfield&gt; | outputlookup &lt;table&gt; append=false </CODE></PRE> Wed, 08 Aug 2018 12:52:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387849#M113136 FritzWittwer_ol 2018-08-08T12:52:51Z https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387850#M113137 <P>Another way to do it:</P> <TABLE><THEAD> <TR> </TR> </THEAD><TBODY> <TR> </TR> <TR> </TR> </TBODY></TABLE> Fri, 01 Nov 2019 12:33:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-data-to-a-lookup-without-overwriting-anything-AND/m-p/387850#M113137 comjb 2019-11-01T12:33:22Z