How to add new entry to lookups and older values are overridden by new values?

[sagar_shubham23]

Why i am getting Duplicate entries while using outputlookups.

Query: 

|inputlookup append=t test1_checks.csv| eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0| outputlookup append=true test1_checks.csv

Result:

Alert Type      Correlated_alert

test2                   test2

test2                   test2

test2                    test2

I need only one entry for all kind of entries in Alert_type and Correlated_alert.

Kindly help

[richgalloway]

The append=true option to outputlookup tells Splunk to keep the existing lookup file content.  To replace the content with the current result set, use append=false (the default).

| inputlookup test1_checks.csv
| eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0
| outputlookup test1_checks.csv

As @somesoni2 mentioned, to eliminate duplicate entries, you need to use the stats or dedup command.

[somesoni2 · Accepted solution]

Give this a try

|inputlookup append=t test1_checks.csv
| append [| makeresults | eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0 | table Alert_type Correlated_alert Correlation_type ]
| stats last(Correlation_type) as Correlation_type by Alert_type Correlated_alert
| outputlookup append=true test1_checks.csv