Hi All,
I would like to populate a lookup using savedsearches but condition being the previous entry from the lookup should only be removed if the current search result returns some values. In case the search does not return any value. the lookup should not be changed.
Can anyone help me with the possible solution for the same.
Hope this works. Give a Try
First command:
|from datamodel:"blahblah"| table "your column" | outputlookup your_lookup.csv
Next command: appends only if it finds additional rows in the output
|from datamodel:"blahblah"| table "your column" | where NOT [|inputlookup your_lookup.csv ] | outputlookup your_lookup.csv append=true
We don't want to append the data to any of the old lookup, it should be a new lookup created when the search returns any results.
So, you can use a new name in your command? But this will create numerous lookup files and very hard for you to manage/housekeep. Mate - what is your exact requirement?
|from datamodel:"blahblah"| table "your column" | where NOT [|inputlookup your_lookup.csv ] | outputlookup your_NEW_lookup.csv
Do your search then read the existing lookup file using the append=true
option. Deduplicate the results and write them back to the lookup file.
No, it just search for the events and write it to lookup. We do not append data as it will become very huge with time going forward
Have a look at the create_empty
and override_if_empty
options of the outputlookup
command to see if they satisfy your requirements.