https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421230#M121004 <P>I have a lookup table file csv. Every now and then I have to add a couple of domains to it along with a hard coded "1" (which I use as a flag). </P> <P>I have a copy of the csv on my desktop, where I manually edit it, and then delete the old version in splunk, and create a new lookup, using the edited csv version.</P> <P>Is there a more efficient way to update it?</P> <P>Thank you</P> Thu, 05 Jul 2018 15:16:54 GMT Log_wrangler 2018-07-05T15:16:54Z https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421230#M121004 <P>I have a lookup table file csv. Every now and then I have to add a couple of domains to it along with a hard coded "1" (which I use as a flag). </P> <P>I have a copy of the csv on my desktop, where I manually edit it, and then delete the old version in splunk, and create a new lookup, using the edited csv version.</P> <P>Is there a more efficient way to update it?</P> <P>Thank you</P> Thu, 05 Jul 2018 15:16:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421230#M121004 Log_wrangler 2018-07-05T15:16:54Z https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421231#M121005 <P>There are couple of alternatives, than having to re upload. If the number of entries are less.</P> <OL> <LI>Install this app and edit the lookup in Splunk itself <A href="https://splunkbase.splunk.com/app/1724/">https://splunkbase.splunk.com/app/1724/</A></LI> <LI>Run a search to update/overwrite using outputlookup <PRE>| inputlookup mylookup.csv | append [|makeresults | eval domain="abc" | eval flag="1" | table domain flag] | outputlookup mylookup.csv </PRE></LI> </OL> Thu, 05 Jul 2018 15:21:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421231#M121005 pradeepkumarg 2018-07-05T15:21:09Z https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421232#M121006 <P>You can install the <CODE>Lookup Editor</CODE> app, or you can just fix it in the SPL with something like this:</P> <PRE><CODE>Your Search For New/Replacement Data here | appendpipe [|inputlookup YourLookup.csv] | dedup YourKeyFieldHere | outputlookup YourLookup.csv </CODE></PRE> <P>The <CODE>dedup</CODE> will cause any new data to supersede any existing data and then the merged set is written back out.</P> Thu, 05 Jul 2018 16:16:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421232#M121006 woodcock 2018-07-05T16:16:54Z https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421233#M121007 <P>your code works great, I could not get it to work because of a 1D10T error, typo, Thank you!</P> Fri, 06 Jul 2018 22:11:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421233#M121007 Log_wrangler 2018-07-06T22:11:12Z https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421234#M121008 <P>Thank you for your reply, I will keep this in mind, however I have to use the above for my situation.</P> Fri, 06 Jul 2018 22:12:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-to-a-lookup-csv-without-having-to-delete-the-old-and/m-p/421234#M121008 Log_wrangler 2018-07-06T22:12:16Z