Splunk Enterprise

How to append /write only new results to outputlookup file

Ashwini008
Builder

Hi 

I want to write my results into outputlookup from saved search. but only when new results are there it should append it to mu lookup.which i am failing to do so

query| outputlookup append=true output.csv. This is writing multiple copies of same data into lookup.

quyery|[|inputlookup output.csv |dedup S] |outputlookup output.csv append=true. This isnt working

Any suggestions

Labels (2)
0 Karma

Ashwini008
Builder

UPDATE :

This worked for me

query | outputlookup output.csv append=true| append[| inputlookup append=true output.csv]| dedup Source | outputlookup output.csv

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try append=false

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

If field S in output.csv is part of index and sourcetype then you can try below query:

index=index sourcetype=sourcetype NOT [|inputlookup output.csv | dedup S | fields S] | outputlookup output.csv append=true
0 Karma

Ashwini008
Builder

@ITWhisperer Tried,but still multiple values.

@manjunathmeti My output.csv is empty. So have to write my index data to output.csv.Query is failing at this point,it shows zero results

index=index sourcetype=sourcetype NOT [|inputlookup output.csv | dedup S | fields S] 

 

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...