Splunk Dev

Is there a way to look at CSV files in the lookup ?

jhartm5
New Member

I created a lookup as a CSV and want to view the contents of the CSV in Splunk. Is there an easy way to accomplish this? I can use the CSV but if I want to look at the contents of the CSV And If I want to edit the CSV I usually delete the CSV and add new. Is there a better way to update the CSV file?

Tags (1)
0 Karma
1 Solution

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

View solution in original post

0 Karma

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

0 Karma

jhartm5
New Member

Thanks for the additional details.

0 Karma

chasrini
New Member

Hi - I am looking to download a inputlookup csv file but I am not able to do that. Is there a way to do that. Thanks.

0 Karma

ssadanala1
Contributor

To view the content of the csv please run

|inputlookup lookupname.csv in the search bar .

If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .

https://splunkbase.splunk.com/app/1724/

jhartm5
New Member

Thanks for getting back so quickly. This worked.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...