How to modify a single row in a lookup file based ... - Splunk Community

Splunk Search

I have a CSV lookup present with 1000 rows as per the below query.

sourcetype="snow:cmdb_ci_service" | stats latest(*) as * by dv_name

If any field needs to be modified based on dv_name row, is it possible to do the changes ?
If yes, how to modify the data using the query?

Hi

Check the solution by @richgalloway

https://answers.splunk.com/answers/755079/how-do-i-update-a-lookup-file-with-updated-informa.html

Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...