topic Re: How do you add search results to an existing lookup? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437798#M124656 <P>I need to see your query .</P> Wed, 30 Jan 2019 21:48:33 GMT Vijeta 2019-01-30T21:48:33Z How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437795#M124653 <P>i have a table that has 30 columns and some rows, </P> <P>table 1 <BR /> column1 column2 ---------- column30<BR /> ww xx -------------------------- aa</P> <P>expecting table will like this <BR /> column1 column2 ---------- column30</P> <H2>ww xx -------------------------- aa</H2> <HR /> <HR /> <P>etc...</P> <P>so my question is how to add more rows to it without deleting the old lookup.</P> Wed, 30 Jan 2019 20:49:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437795#M124653 rajasekhar14 2019-01-30T20:49:06Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437796#M124654 <PRE><CODE>&lt;your query&gt;| outputlookup append=true &lt;yourlookupname&gt; </CODE></PRE> Wed, 30 Jan 2019 21:24:31 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437796#M124654 Vijeta 2019-01-30T21:24:31Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437797#M124655 <P>thanks @vijeta its appending all results again and again. it be coming duplicates rows every time? my goal is, we have a existing table with some values(rows) and when ever i search it give the same values or new values. So if the values are same as in table it no need to add those values to existing table. if the values are new only it need to add to that lookup table.</P> Wed, 30 Jan 2019 21:39:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437797#M124655 rajasekhar14 2019-01-30T21:39:30Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437798#M124656 <P>I need to see your query .</P> Wed, 30 Jan 2019 21:48:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437798#M124656 Vijeta 2019-01-30T21:48:33Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437799#M124657 <P>i using another lookup table to search the data, my query will be like this<BR /> |inputlookup my_lookup | eval a=b |eval c=g |eval d=e | table b g e|outputlookup new_lookup <BR /> after your answer i changed my query to like this<BR /> |inputlookup my_lookup | eval a=b |eval c=g |eval d=e | table b g e |outputlookup append=true new_lookup </P> Tue, 29 Sep 2020 23:01:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437799#M124657 rajasekhar14 2020-09-29T23:01:23Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437800#M124658 <P>This will add to your new lookup whatever you are getting from old lookup. Do you want to overwrite new lookup ?</P> Wed, 30 Jan 2019 22:08:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437800#M124658 Vijeta 2019-01-30T22:08:23Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437801#M124659 <P>NO, if there are any new values coming from my search that values to be add my new lookup table. which type of command do i need to use ?</P> Wed, 30 Jan 2019 22:15:08 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437801#M124659 rajasekhar14 2019-01-30T22:15:08Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437802#M124660 <P>In that case append= false, did you try that.</P> Wed, 30 Jan 2019 22:18:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437802#M124660 Vijeta 2019-01-30T22:18:06Z Re: How do you add search results to an existing lookup? https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437803#M124661 <P>Try this:</P> <P>| appendpipe [| inputlookup abc.csv ] | eval key = column1."|".column2."|".column3<BR /> | dedup key<BR /> |outputlookup abc.csv append=false</P> Thu, 31 Jan 2019 06:16:50 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-add-search-results-to-an-existing-lookup/m-p/437803#M124661 vishaltaneja070 2019-01-31T06:16:50Z