topic Re: Modifying CSV in Splunk Search

Is it possible to modify a portion of CSV file in inputlookup?

majilan1 — Thu, 18 Aug 2022 05:12:55 GMT

Hi Every one,

Is it possible to modify a portion of CSV file in inputlookup?

Cheers.

Re: Modifying CSV

bowesmana — Thu, 18 Aug 2022 00:22:20 GMT

Are you looking to read the CSV, make some modifications and save it back again? If so, 2 approaches.

The first is to simply input, change as needed and then output, e.g.

| inputlookup your.csv | eval field_value=if(field_value="I want this field", "change me", field_value) | outputlookup your.csv

or you can use the lookup editor to manually edit the lookup

https://splunkbase.splunk.com/app/1724/

Re: Modifying CSV

majilan1 — Thu, 18 Aug 2022 12:31:50 GMT

Thanks bowesmana,

Re: Modifying CSV

bowesmana — Thu, 18 Aug 2022 04:27:43 GMT

this should do it

REMEMBER: if you plan to do this automatically - please make sure you have a backup copy of the original in case you get the SPL wrong first time!!!

| inputlookup host_blackout.csv | eval end_time=if(host IN ("mep1", "mep2", "mep3"), "08/28/2022 11:00", end_time) | oututlookup host_blackout.csv

It sounds like you could also use the eval function 'relative_time()' to calculate the 'end of next week', e.g. like this

| inputlookup host_blackout.csv | eval end_time=if(host IN ("mep1", "mep2", "mep3"), strftime(relative_time(now(), "+2w@w7+11h"), "%m/%d/%Y %H:%M"), end_time) | oututlookup host_blackout.csv

which would make it 11am on Sunday in the week following

Re: Modifying CSV

majilan1 — Thu, 18 Aug 2022 01:35:53 GMT

I get error in 'EvalCommand': the expression is malformed. Expected).

Re: Modifying CSV

bowesmana — Thu, 18 Aug 2022 04:28:12 GMT

The eval 'case' statement was meant to be an 'if'. Fixed