Splunk Search

How to append data to a lookup without overwriting anything AND also not adding duplicate data entries into the lookup?

Robbie1194
Communicator

Hi guys,

I was wondering if anyone knew of a method of appending data to a lookup, but not overwriting anything in the lookup AND also not adding duplicate data entries into the lookup?

Any suggestions would be helpful.

Cheers,
Robbie

0 Karma
1 Solution

FritzWittwer_ol
Contributor
| inputlookup <table>
| append [makeresults | eval .... | fields - _time]
| dedup <keyfield>
| outputlookup <table> append=false

View solution in original post

comjb
Loves-to-Learn Lots

Another way to do it:

0 Karma

FritzWittwer_ol
Contributor
| inputlookup <table>
| append [makeresults | eval .... | fields - _time]
| dedup <keyfield>
| outputlookup <table> append=false
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...