Hi Splunkers,
I am writing on SPL in the report which has lookup. And if the lookup has less number of rows then overwrite the lookup with existing static lookup.
Example:
<myseach>
| outputlookup test1.csv
| stats count
| < if/where condition , where i need to check if the count < 100 , then overwrite existing static lookup into test1.csv else remain as-is"
count < 100 , "| inputlookup testlookup.csv | outputlookup test1.csv" , "test1.csv"
