Splunk Search

How to add to a lookup csv without having to delete the old and create it again?

Log_wrangler
Builder

I have a lookup table file csv. Every now and then I have to add a couple of domains to it along with a hard coded "1" (which I use as a flag).

I have a copy of the csv on my desktop, where I manually edit it, and then delete the old version in splunk, and create a new lookup, using the edited csv version.

Is there a more efficient way to update it?

Thank you

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer

There are couple of alternatives, than having to re upload. If the number of entries are less.

  1. Install this app and edit the lookup in Splunk itself https://splunkbase.splunk.com/app/1724/
  2. Run a search to update/overwrite using outputlookup
    | inputlookup mylookup.csv | append [|makeresults | eval domain="abc" | eval flag="1" | table domain flag] | outputlookup mylookup.csv 

View solution in original post

woodcock
Esteemed Legend

You can install the Lookup Editor app, or you can just fix it in the SPL with something like this:

Your Search For New/Replacement Data here
| appendpipe [|inputlookup YourLookup.csv]
| dedup YourKeyFieldHere
| outputlookup YourLookup.csv

The dedup will cause any new data to supersede any existing data and then the merged set is written back out.

0 Karma

Log_wrangler
Builder

Thank you for your reply, I will keep this in mind, however I have to use the above for my situation.

0 Karma

pradeepkumarg
Influencer

There are couple of alternatives, than having to re upload. If the number of entries are less.

  1. Install this app and edit the lookup in Splunk itself https://splunkbase.splunk.com/app/1724/
  2. Run a search to update/overwrite using outputlookup
    | inputlookup mylookup.csv | append [|makeresults | eval domain="abc" | eval flag="1" | table domain flag] | outputlookup mylookup.csv 

Log_wrangler
Builder

your code works great, I could not get it to work because of a 1D10T error, typo, Thank you!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...