Is there a way to look at CSV files in the lookup ?

[jhartm5]

I created a lookup as a CSV and want to view the contents of the CSV in Splunk. Is there an easy way to accomplish this? I can use the CSV but if I want to look at the contents of the CSV And If I want to edit the CSV I usually delete the CSV and add new. Is there a better way to update the CSV file?

[PowerPacked · Accepted solution]

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

[jhartm5]

Thanks for the additional details.

[chasrini]

Hi - I am looking to download a inputlookup csv file but I am not able to do that. Is there a way to do that. Thanks.

[ssadanala1]

To view the content of the csv please run

|inputlookup lookupname.csv in the search bar .

If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .

https://splunkbase.splunk.com/app/1724/

[jhartm5]

Thanks for getting back so quickly. This worked.