Splunk Search

How to add to a lookup csv without having to delete the old and create it again?

Log_wrangler
Builder

I have a lookup table file csv. Every now and then I have to add a couple of domains to it along with a hard coded "1" (which I use as a flag).

I have a copy of the csv on my desktop, where I manually edit it, and then delete the old version in splunk, and create a new lookup, using the edited csv version.

Is there a more efficient way to update it?

Thank you

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer

There are couple of alternatives, than having to re upload. If the number of entries are less.

  1. Install this app and edit the lookup in Splunk itself https://splunkbase.splunk.com/app/1724/
  2. Run a search to update/overwrite using outputlookup
    | inputlookup mylookup.csv | append [|makeresults | eval domain="abc" | eval flag="1" | table domain flag] | outputlookup mylookup.csv 

View solution in original post

woodcock
Esteemed Legend

You can install the Lookup Editor app, or you can just fix it in the SPL with something like this:

Your Search For New/Replacement Data here
| appendpipe [|inputlookup YourLookup.csv]
| dedup YourKeyFieldHere
| outputlookup YourLookup.csv

The dedup will cause any new data to supersede any existing data and then the merged set is written back out.

0 Karma

Log_wrangler
Builder

Thank you for your reply, I will keep this in mind, however I have to use the above for my situation.

0 Karma

pradeepkumarg
Influencer

There are couple of alternatives, than having to re upload. If the number of entries are less.

  1. Install this app and edit the lookup in Splunk itself https://splunkbase.splunk.com/app/1724/
  2. Run a search to update/overwrite using outputlookup
    | inputlookup mylookup.csv | append [|makeresults | eval domain="abc" | eval flag="1" | table domain flag] | outputlookup mylookup.csv 

Log_wrangler
Builder

your code works great, I could not get it to work because of a 1D10T error, typo, Thank you!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...