topic Re: How to read content of refreshed csv file via lookup in Splunk Search

How to read content of refreshed csv file via lookup

sudeep5689 — Sun, 17 May 2020 06:08:42 GMT

Hi, i have configured a csv lookup in splunk. Now i want to change the content of csv file so that it gets updated in splunk lookup search. Is there a way to this

Re: How to read content of refreshed csv file via lookup

sanjeev543 — Sun, 17 May 2020 08:33:38 GMT

Hi,

There are few ways to perform this,

Convert your file based lookup to kvstore, which helps you to change the content easy (https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/ConfigureKVstorelookups)
Use lookup editor app to modify contents in the lookup (https://splunkbase.splunk.com/app/1724/)
Write a search to modify the contents and update the samelookup |inputlookup abc.csv | <content modify search> | outputlookup abc.csv Your <content modify search> can be something like |eval <fieldname>=if(fieldname=="something","newvalue","oldvalue") etc., to update field such as fieldname values with the new content. Above logic varies based on your requirement, please check eval documentation here (https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/CommonEvalFunctions)

Re: How to read content of refreshed csv file via lookup

sudeep5689 — Sun, 17 May 2020 08:45:23 GMT

Thanks. My objective over here is that i am having some static content which i am loading into the csv file and then reading it using inputlookup. After updating the content curently i have to replace the file in splunk back again.

Re: How to read content of refreshed csv file via lookup

sanjeev543 — Sun, 17 May 2020 09:41:27 GMT

@sudeep5689 Yes, may be 2nd option or 3rd option works for you.
If my solution helps, please mark it as answered