topic Re: Update Lookup csv by Splunk Output in Splunk Search

Update Lookup csv by Splunk Output

RahulMisra1 — Mon, 17 Jun 2024 12:16:11 GMT

How i update the test_MID_IP.csv with the output IP, so that next time it runs with updated list

index=abc IP!="10.*" [| inputlookup ip_tracking.csv 
  | rename test_DATA AS MID | format ] 
| lookup test_MID_IP.csv test_IP as IP OUTPUT test_IP 
| eval match=if('IP'== test_IP, "yes", "no")
| search match=no 
| stats count by IP

Re: Update Lookup csv by Splunk Output

inventsekar — Mon, 17 Jun 2024 12:20:02 GMT

Hi @RahulMisra1

the outputlookup command is used to write the lookup file (we can overwrite or append the lookup file)

Pls note - this one overwrites the lookup file.. if you want to append, pls let us know..

Re: Update Lookup csv by Splunk Output

RahulMisra1 — Mon, 17 Jun 2024 12:53:47 GMT

Thanks. I want to append the IP to the existing lookup

test_MID_IP.csv

Re: Update Lookup csv by Splunk Output

yuanliu — Tue, 18 Jun 2024 04:57:19 GMT

I think the OP's test_MID_IP.csv contains test_IP, not IP. (Although it doesn't need to be.) It doesn't need count but may (or may not) need MID. Also, the append option is needed for the table preserve all data.