Splunk Dev

Is there a way to look at CSV files in the lookup ?

jhartm5
New Member

I created a lookup as a CSV and want to view the contents of the CSV in Splunk. Is there an easy way to accomplish this? I can use the CSV but if I want to look at the contents of the CSV And If I want to edit the CSV I usually delete the CSV and add new. Is there a better way to update the CSV file?

Tags (1)
0 Karma
1 Solution

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

View solution in original post

0 Karma

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

0 Karma

jhartm5
New Member

Thanks for the additional details.

0 Karma

chasrini
New Member

Hi - I am looking to download a inputlookup csv file but I am not able to do that. Is there a way to do that. Thanks.

0 Karma

ssadanala1
Contributor

To view the content of the csv please run

|inputlookup lookupname.csv in the search bar .

If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .

https://splunkbase.splunk.com/app/1724/

jhartm5
New Member

Thanks for getting back so quickly. This worked.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...