topic Re: Updating a value in a lookup in Splunk Search

Updating a value in a lookup

joe06031990 — Wed, 30 Jun 2021 21:46:58 GMT

Hello,

I have a lookup called top sites with the bellow:

Name	Ip address
test1	10.10.10.10
test2	10.10.10.11
Test3	10.10.10.12
Test4	10.10.10.11
Test5	10.10.10.11

I am trying to update test3 IP address with the bellow:

However it just adds another entry instead pf replacing the IP address value, what am I missing?

Thanks

Re: Updating a value in a lookup

ITWhisperer — Wed, 30 Jun 2021 23:07:04 GMT

Try something like this:

| inputlookup topsites.csv | eval 'Ip address'=if(Name="Test3","9.9.9.9",'Ip address') | outputlookup createinapp=true topsites.csv

Re: Updating a value in a lookup

joe06031990 — Thu, 01 Jul 2021 06:43:21 GMT

Good Morning,

Thanks for your reply,

when I run the search it adds another column with the updated value called 'Ip address' instead of updating the existing field value, is there a way around this?

Thanks

Joe

Re: Updating a value in a lookup

ITWhisperer — Thu, 01 Jul 2021 06:47:22 GMT

From your original post, it looks like the field is called 'ip address' - if this is not the case, then use the real field name instead of 'ip address'