Splunk Enterprise

How to search ingesting data in lookup?

smanojkumar
Communicator

I would like to know about to add a single field value to outputlookup, as currently there are some fields like id, condition, value is there , but the need is only to ingest condition, Can anyone provide the query for this.

Labels (1)
0 Karma
1 Solution

marysan
Communicator

inputlookup mylookup.csv
|fields condition
|outputlookup mylookup.csv (OR  outputlookup mylookup2.csv)

View solution in original post

marysan
Communicator

inputlookup mylookup.csv
|fields condition
|outputlookup mylookup.csv (OR  outputlookup mylookup2.csv)

richgalloway
SplunkTrust
SplunkTrust

The inputlookup command does have a way to specify which field(s) to return.  You can, however, use the fields command for that.

| inputlookup mylookup.csv | fields condition

 

---
If this reply helps you, Karma would be appreciated.

smanojkumar
Communicator

Hi @richgalloway ,

    It is kind of storing data in lookup, so for storing data in lookup that should be one field, so that i mentioned outputlookup.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thank for that.  You also mentioned "ingest" twice so no wonder I mis-understood.

Lookup files must be updated in their entirety.  You cannot replace a single row or field.  @marysan has the right answer for replacing the entire lookup with a single column.

To be able to updated individual fields in a lookup, use a KVStore collection.

---
If this reply helps you, Karma would be appreciated.

marysan
Communicator

Hi

there is some ways to update just one field in a lookup
for example we have a lookup with (IP,reported) fields
if you want to change reported field from 0 to 1 just for a specific IP,for example IP:1.2.3.4 , and you dont want to change other values :
|inputlookup mylookup.csv
|eval reported=if(IP="1.2.3.4",0,reported)
|outputlookup mylookup.csv

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That is the method for updating a lookup file, but to be clear, the outputlookup command rewrites the entire lookup even if only a single bit is different.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...