https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60569#M14902 <P>How is your lookup file being populated? If you are using the outputlookup command you can append new data so the older data is not lost </P> <P><CODE>| outputlookup somefile.csv append=t</CODE></P> Wed, 12 Jun 2013 02:38:44 GMT cramasta 2013-06-12T02:38:44Z https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60568#M14901 <P>Hi,</P> <P>I am encountering a problem in lookups. The problem is that whenever the lookup file gets updated with new data, SPLUNK does not recognise the fields from the older data. </P> <P>Say <BR /> older file had <BR /> <BR /> ABC,RNC02,136,3G-000-001 <BR /><BR /> New one has <BR /><BR /> ABC,RNC03,136,3G-000-001</P> <P>and we do search for RNC02, is does not find the field description containing 3G-000-001</P> <P>So, is there any way to bind the lookup with the data itself so as to keep the historical data consistent.</P> <P>Thanks</P> Wed, 12 Jun 2013 01:55:27 GMT https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60568#M14901 saad_siddiqi 2013-06-12T01:55:27Z https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60569#M14902 <P>How is your lookup file being populated? If you are using the outputlookup command you can append new data so the older data is not lost </P> <P><CODE>| outputlookup somefile.csv append=t</CODE></P> Wed, 12 Jun 2013 02:38:44 GMT https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60569#M14902 cramasta 2013-06-12T02:38:44Z https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60570#M14903 <P>The lookup file gets ftped through a cron job every day.</P> Wed, 12 Jun 2013 03:14:03 GMT https://community.splunk.com/t5/Splunk-Search/Historical-Lookups/m-p/60570#M14903 saad_siddiqi 2013-06-12T03:14:03Z