All Apps and Add-ons

How do I store a specific field in lookup?

smanojkumar
Communicator

Hi There!

    I need to add a specific field in the lookup and keeping the all old data as it is,

   I'm having lookup1_kvstore , which consists of several fields and check_date as well
   also lookup2.csv consists of check_date, src_name , I need to update check_date from lookup2.csv to lookup1_kvstore and keeping all the old fields as it is except check_date.

 

Thanks in Advance!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming src_name exists in both lookups, try something like this

| inputlookup lookup1_kvstore
| lookup lookup2.csv src_name OUTPUT check_date
| outputlookup lookup1_kvstore
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...