How do you append new results in a lookup file?

[chanthongphiob]

I have a lookup table that runs every month of previous successful logins. For example:

Account_Name, Host
alpha, comp1 comp2 comp3
bravo, comp1 comp3
charlie, comp2

Now I have a scheduled report to run daily to determine any differences between the lookup file and account names and hosts of new daily logons. So, for example, if the new data is...

Account_Name, Host
alpha, comp4
alpha, comp5
bravo, comp2
charlie, comp1

I want my new lookup table to compensate for this. New result set will be as follow:
Account_Name, Host
alpha, comp1 comp2 comp3 comp4 comp5
bravo, comp1 comp2 comp3
charlie, comp1 comp2

How do I write the outputlookup portion to append the new data to the old data in the lookup file?

My query is as follow to obtain new data:
index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host

[493669 · Accepted solution]

Hi @chanthongphiob,
Try this:

index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv

[inventsekar]

Are you guys sure of this method with tstats? 

| tstats count where (index=test* earliest="2/1/2020:00:00:00" latest="3/1/2020:00:00:00") BY _time span=1d 
| inputlookup append=true testlookup.cvs 
| outputlookup testlookup.csv

[jameswatts]

search blah | inputlookup append=true X.cvs | outputlookup X.csv