Why i am getting Duplicate entries while using outputlookups.
Query:
|inputlookup append=t test1_checks.csv| eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0| outputlookup append=true test1_checks.csv
Result:
Alert Type Correlated_alert
test2 test2
test2 test2
test2 test2
I need only one entry for all kind of entries in Alert_type and Correlated_alert.
Kindly help
Give this a try
|inputlookup append=t test1_checks.csv
| append [| makeresults | eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0 | table Alert_type Correlated_alert Correlation_type ]
| stats last(Correlation_type) as Correlation_type by Alert_type Correlated_alert
| outputlookup append=true test1_checks.csv
The append=true option to outputlookup tells Splunk to keep the existing lookup file content. To replace the content with the current result set, use append=false (the default).
| inputlookup test1_checks.csv
| eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0
| outputlookup test1_checks.csv
As @somesoni2 mentioned, to eliminate duplicate entries, you need to use the stats or dedup command.
Give this a try
|inputlookup append=t test1_checks.csv
| append [| makeresults | eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0 | table Alert_type Correlated_alert Correlation_type ]
| stats last(Correlation_type) as Correlation_type by Alert_type Correlated_alert
| outputlookup append=true test1_checks.csv