Splunk Cloud Platform

How to update the blackout for three hosts(mep1,mep2,mep3) among the 30 hosts I have?

Miky
Explorer

Hi Guys,

I have a host_blackout.csv, and I want to update the blackout for three hosts(mep1,mep2,mep3) among the 30 hosts I have:

1) the new end_time should be updated to end of next week("08/28/202 11:00").

My output looks like this:

end_time

host

notes

start_time

08/18/2022 09:00

mep1

INC000006

08/14/2022 23:00

08/11/2022 09:00

mep2

INC000002

08/11/2022 20:15

08/12/2022 10:00

mep3

INC000003

08/10/2022 12:00

08/10/2022 09:00

mep4

INC000004

08/06/2022 23:00

08/05/2022 09:00

mep5 INC0000012

10/27/2018 00:00

08/05/2022 09:00

mep6 INC00000123

08/03/2022 23:00

08/05/2022 09:00

mep7 INC000002537

10/27/2018 00:00

08/05/2022 09:00

mep8 INC0000011

11/20/2018 00:00

08/05/2022 09:00

mep9

 

Can you help please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to update a single entry in a CSV file - you have to update the entire file.  Fortunately, that's not difficult.  The steps are: 1) read the existing file; 2) make the desired changes; 3) rewrite the file.

| inputlookup host_blackout.csv
| <<your SPL to make the desired changes>>
| outputlookup host_blackout.csv
---
If this reply helps you, Karma would be appreciated.
0 Karma

Miky
Explorer

Thanks rich as always,

How would the SPL looks like to do the changes.

I'm stuck implementing that SPL language.

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's a big box of Depends.  It could be a simple eval:

| eval start_time = if(host="mep1", now(), start_time)

or something much more complex.  It depends on how you decide which row to update.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...