topic Re: how to add a new column to existing inputlookup in Splunk Search

how to add a new column to existing inputlookup

james_n — Thu, 14 May 2020 14:52:56 GMT

Hi Experts,

Hi have existing inputlookup file like test.csv which contains 3 fields like host source sourcetype, i want to add extra one new filed called _time with these 3 fields. I have tried with basesearch | table host source soursetype _time|outputlookup test.csv append=true but new field is not appending

for example if I have this existing csv file contains 100 rows, then these 3 fileds along with new filed results shold be added from 101th row onwards in the csv. Plz help on this and thanks in advance.

Re: how to add a new column to existing inputlookup

richgalloway — Thu, 14 May 2020 15:14:38 GMT

I think you need to re-write the entire CSV so the header has the new field name.

| inputlookup test.csv
| append [ basesearch ]
| dedup host source sourcetype
| table host source sourcetype _time
| outputlookup test.csv

The dedup command presumes you want unique tuples in your lookup file. If that's not the case, remove dedup.