Getting Data In

Update only specific field in csv



I am running a search query which take input from lookup and generate counts for each row. And I want to update only specific column "No_Of_MXTIMING_Events" in the csv. It should't change the row count and I don't want to rewrite full csv again.

Query to generate "No_Of_MXTIMING_Events"

| inputlookup Test_Row_Count.csv | where isnull(No_TPS_Events) OR isnull(No_TPS_Events)
| eval Start_epoc=Start 
| eval Stop_epoc=Stop 
| table ID, Start_epoc , Stop_epoc, Host 
| map maxsearches=1001 search="| tstats summariesonly=true count(MXTIMING.Elapsed) as No_Of_MXTIMING_lines FROM datamodel=MXTIMING_V8 WHERE 
    host=$Host$ earliest=$Start_epoc$ latest=$Stop_epoc$  | eval ID=\"$ID$\" | eval Host=\"$Host$\" " 
| sort 0 - by ID 
| table ID, Host, No_Of_MXTIMING_lines

alt text

0 Karma


Simply put, you can't. KV Store lookups allow to only update certain records, but CSV lookups can only be written as a whole.
You therefore have to do | inputlookup, then do your change, and then do | outputlookup so all data is written back to the lookup.

You could however replace | table in your example with | fields. The | table command is only used for graphical representation, and is considerably slower than | fields, although it has the same effect in your use case.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...