Reporting
Highlighted

Populating Lookup using saved search

Path Finder

Hi All,

I would like to populate a lookup using savedsearches but condition being the previous entry from the lookup should only be removed if the current search result returns some values. In case the search does not return any value. the lookup should not be changed.

Can anyone help me with the possible solution for the same.

0 Karma
Highlighted

Re: Populating Lookup using saved search

SplunkTrust
SplunkTrust

Do your search then read the existing lookup file using the append=true option. Deduplicate the results and write them back to the lookup file.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Populating Lookup using saved search

Path Finder

No, it just search for the events and write it to lookup. We do not append data as it will become very huge with time going forward

0 Karma
Highlighted

Re: Populating Lookup using saved search

SplunkTrust
SplunkTrust

Have a look at the create_empty and override_if_empty options of the outputlookup command to see if they satisfy your requirements.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Populating Lookup using saved search

Builder

Hope this works. Give a Try

First command:

|from datamodel:"blahblah"| table "your column" | outputlookup your_lookup.csv

Next command: appends only if it finds additional rows in the output

|from datamodel:"blahblah"| table "your column" | where NOT [|inputlookup yourlookup.csv ] | outputlookup yourlookup.csv append=true

0 Karma
Highlighted

Re: Populating Lookup using saved search

Path Finder

We don't want to append the data to any of the old lookup, it should be a new lookup created when the search returns any results.

0 Karma
Highlighted

Re: Populating Lookup using saved search

Builder

So, you can use a new name in your command? But this will create numerous lookup files and very hard for you to manage/housekeep. Mate - what is your exact requirement?

|from datamodel:"blahblah"| table "your column" | where NOT [|inputlookup yourlookup.csv ] | outputlookup yourNEW_lookup.csv

0 Karma