Splunk Search

How to add a new row to a lookup using a Splunk query?

agentsofshield
Path Finder

Is there a Splunk query to add a new row or a new column to a lookup table?

I specifically ask for a query because I want my Python script to append rows automatically.

Thanks.

1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>

OR

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

View solution in original post

nickhills
Ultra Champion

One approach, which I find most robust is:

1.) Open your original lookup.
2.) Table your new row
3.) Dedup (if necessary)
4.) Write the updated lookup

 [your search which produces results of 1 or more rows]
| inputlookup append=true mylookup.csv
|table field_id, field_a, field_b
|dedup field_id
|outputlookup mylookup.csv

Using this method you can add both rows and columns if needed by including them in the table command. This will load the 'old copy' of the file, and re-write the file with all the rows/columns present in the table.

If my comment helps, please give it a thumbs up!

agentsofshield
Path Finder

But I'm not taking my new values from a Splunk search. It's from a Python script. How do I just put specific values in the lookup?

0 Karma

nickhills
Ultra Champion

A python script running outside of splunk?
If so, you just need to configure the script to write a new line (and optionally a header if you're adding new cols) to the csv in the lookups directory, but you will want to include error handling etc to make sure you don't trash the original file.

If my comment helps, please give it a thumbs up!
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>

OR

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

agentsofshield
Path Finder

How do I "make results"?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

As you are using python so first create splunk query using python, if you want to add more results then you can do something like this while creating query.

Create variable called ip and with all values delimited with semicolon so something like this ip="3.4.5.6;10.10.0.1" and then use below splunk query

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="3.4.5.6;10.10.0.1" ]
| table ip
| eval ip=split(ip,";")
| mvexpand ip
| dedup ip
| outputlookup <existing_lookup.csv>

and then fire above query in splunk using python script.

agentsofshield
Path Finder

Didn't help, can I get the specific example?

0 Karma

vnravikumar
Champion

Hi

Try with outputlookup command

ex:

|makeresults |eval id=3,name="test3" | outputlookup append=true samplelookup
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...