Splunk Search

How to add a new row to a lookup using a Splunk query?

agentsofshield
Path Finder

Is there a Splunk query to add a new row or a new column to a lookup table?

I specifically ask for a query because I want my Python script to append rows automatically.

Thanks.

1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>

OR

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

View solution in original post

nickhills
Ultra Champion

One approach, which I find most robust is:

1.) Open your original lookup.
2.) Table your new row
3.) Dedup (if necessary)
4.) Write the updated lookup

 [your search which produces results of 1 or more rows]
| inputlookup append=true mylookup.csv
|table field_id, field_a, field_b
|dedup field_id
|outputlookup mylookup.csv

Using this method you can add both rows and columns if needed by including them in the table command. This will load the 'old copy' of the file, and re-write the file with all the rows/columns present in the table.

If my comment helps, please give it a thumbs up!

agentsofshield
Path Finder

But I'm not taking my new values from a Splunk search. It's from a Python script. How do I just put specific values in the lookup?

0 Karma

nickhills
Ultra Champion

A python script running outside of splunk?
If so, you just need to configure the script to write a new line (and optionally a header if you're adding new cols) to the csv in the lookups directory, but you will want to include error handling etc to make sure you don't trash the original file.

If my comment helps, please give it a thumbs up!
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>

OR

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

View solution in original post

agentsofshield
Path Finder

How do I "make results"?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

As you are using python so first create splunk query using python, if you want to add more results then you can do something like this while creating query.

Create variable called ip and with all values delimited with semicolon so something like this ip="3.4.5.6;10.10.0.1" and then use below splunk query

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="3.4.5.6;10.10.0.1" ]
| table ip
| eval ip=split(ip,";")
| mvexpand ip
| dedup ip
| outputlookup <existing_lookup.csv>

and then fire above query in splunk using python script.

0 Karma

vnravikumar
Champion

agentsofshield
Path Finder

Didn't help, can I get the specific example?

0 Karma

vnravikumar
Champion

Hi

Try with outputlookup command

ex:

|makeresults |eval id=3,name="test3" | outputlookup append=true samplelookup
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!