How to update CSV ?

[colinmchugo]

Hi all,

I am looking to have a csv with a number of rows and columns. I would like that when the CSV gets updated e.g. with new field that the query is run and then the output is put into a new column field (status) in that row to be changed to e.g. status "Detected"

Does this make sense ? Has anyone the 1,2,3 steps please? thanks in advance.

[muebel]

Hi colinmchugo, the basic process of updating a CSV based lookup is to '| inputlookup' the CSV in question, modify the values as desired with eval and other searchtime field manipulating commands, and then '| outputlookup' back to the same CSV to commit the changes.

If you'd like to have more featureful datastore, you can utilize KVStore collections http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZK

This allows for direct update of specific fields, without rewriting the whole lookup.

Please let me know if this answers your question!