Splunk Search

How do you append new results in a lookup file?

chanthongphiob
Path Finder

I have a lookup table that runs every month of previous successful logins. For example:

Account_Name, Host
alpha, comp1 comp2 comp3
bravo, comp1 comp3
charlie, comp2

Now I have a scheduled report to run daily to determine any differences between the lookup file and account names and hosts of new daily logons. So, for example, if the new data is...

Account_Name, Host
alpha, comp4
alpha, comp5
bravo, comp2
charlie, comp1

I want my new lookup table to compensate for this. New result set will be as follow:
Account_Name, Host
alpha, comp1 comp2 comp3 comp4 comp5
bravo, comp1 comp2 comp3
charlie, comp1 comp2

How do I write the outputlookup portion to append the new data to the old data in the lookup file?

My query is as follow to obtain new data:
index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host

1 Solution

493669
Super Champion

Hi @chanthongphiob,
Try this:

index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv

View solution in original post

0 Karma

493669
Super Champion

Hi @chanthongphiob,
Try this:

index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv
0 Karma

inventsekar
Super Champion

Are you guys sure of this method with tstats? 

| tstats count where (index=test* earliest="2/1/2020:00:00:00" latest="3/1/2020:00:00:00") BY _time span=1d 
| inputlookup append=true testlookup.cvs
| outputlookup testlookup.csv

 

0 Karma

jameswatts
Explorer

search blah | inputlookup append=true X.cvs | outputlookup X.csv

Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...