topic How to update a new row in lookup file using eval command or some other command? in Splunk Search

How to update a new row in lookup file using eval command or some other command?

Rajiv_splunk — Sat, 30 Jul 2022 16:05:05 GMT

Hello everyone,

I have a lookup file which have 5 entry with filed name and field value as below

"New_field"="yes", New_field1="yes", "New_field3"="yes", New_field4="Yes"

I need to append a new row to the lookup file with all the field value as "No". I am using the below command to do this

|inputlookup sample_demo.csv
|append [|inputlookup sample_demo.csv|eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]

this query is adding the new row but its adding 5 new row... I just need one row to append with new field value as "no"

Can anyone please guide me on this, as what am i missing in the query

Re: How to update a new row in lookup file using eval command or some other command?

richgalloway — Sat, 30 Jul 2022 16:47:40 GMT

There's no need to re-read the lookup file in the append. Just append the new fields and write the whole thing back to the lookup.

You also can do it without reading the lookup.

| makeresults | eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no" | table New_field, New_field1, New_field2, New_field3, New_field4 | outputlookup append=1 sample_demo.csv

Re: How to update a new row in lookup file using eval command or some other command?

Rajiv_splunk — Sat, 30 Jul 2022 17:13:40 GMT

Thanks a ton @richgalloway for your quick reply. It works like a charm 🙂

Re: How to update a new row in lookup file using eval command or some other command?

Rajiv_splunk — Sat, 30 Jul 2022 17:16:21 GMT

I got stuck in an another issue..how would i add multiple rows in lookup file through query if only one field vlaue i have to change. say i also have to add all the field value as "yes" and all the field value as "accepted"

Re: How to update a new row in lookup file using eval command or some other command?

Rajiv_splunk — Sat, 30 Jul 2022 17:22:25 GMT

i got it fixed...run the eval command again...Thanks