https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464612#M130931 <P>The basic approach is to read in the CSV file, change what needs to be changed, and then re-write the file.</P> <PRE><CODE>| inputlookup my.csv | eval Name = if(Name=="Test_4", "Test_8", Name) | outputlookup my.csv </CODE></PRE> Tue, 31 Mar 2020 12:41:33 GMT richgalloway 2020-03-31T12:41:33Z https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464611#M130930 <P>I have existing lookup csv. I want to update a row with new value.<BR /> ID Name Location<BR /> 549 Test_1 Bangalore<BR /> 549 Test_2 Delhi<BR /> 729 Test_3 Mumbai<BR /> 549 Test_4 Bangalore<BR /> 729 Test_5 Bangalore</P> <P>Test_4 will be replace with Test_8 and my lookup table will be look like as below</P> <P>ID Name Location<BR /> 549 Test_1 Bangalore<BR /> 549 Test_2 Delhi<BR /> 729 Test_3 Mumbai<BR /> 549 Test_8 Bangalore<BR /> 729 Test_5 Bangalore</P> <P>How can I achieve it through search query. </P> <P>Regards<BR /> Raja</P> Wed, 30 Sep 2020 04:50:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464611#M130930 patra966 2020-09-30T04:50:13Z https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464612#M130931 <P>The basic approach is to read in the CSV file, change what needs to be changed, and then re-write the file.</P> <PRE><CODE>| inputlookup my.csv | eval Name = if(Name=="Test_4", "Test_8", Name) | outputlookup my.csv </CODE></PRE> Tue, 31 Mar 2020 12:41:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464612#M130931 richgalloway 2020-03-31T12:41:33Z https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464613#M130932 <P>Let consider another scenario.</P> <P>If my Name column suppose to be "Test Name". </P> <H2>Case-1:</H2> <P>| inputlookup my.csv<BR /> | eval "Test Name" = if("Test Name"=="Test_4", "Test_8", "Test Name")<BR /> | outputlookup my.csv</P> <P>For this I am getting like below:<BR /> ID Test Name Location<BR /> 549 Test Name Bangalore<BR /> 549 Test Name Delhi<BR /> 729 Test Name Mumbai<BR /> 549 Test Name Bangalore<BR /> 729 Test Name Bangalore</P> <H2>Case- 2:</H2> <P>| inputlookup my.csv<BR /> | eval Test Name = if(Test Name=="Test_4", "Test_8", Test Name)<BR /> | outputlookup my.csv<BR /> Getting error for this. </P> Wed, 30 Sep 2020 04:51:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-update-particular-row-of-existing-lookup-csv/m-p/464613#M130932 patra966 2020-09-30T04:51:35Z