Splunk Search

How to read and write data to CSV lookup?

sbimizry
Engager

Hi, I must write and read data from lookup files.

Example:
cn,srcip,destip,owner
"Canada","207.188.75.136","192.1.104.10","user1"
"USA","62.249.72.118","192.168.1.11","user2"

and I tried to read data using | lookup file cn AS cn | table cn`but it did not work.
and this too
| lookup file cn OUTPUT cn`.

What should I do?

0 Karma
1 Solution

sheamus69
Communicator

If all you want to do is read the contents of the lookup try the inputlookup command.

For example,

|inputlookup file.csv

will list the entire contents of the lookup. You can search for a specific entry in the lookup using:

|inputlookup file.csv | search fieldname=whatever

To perform a lookup against the csv during a search would use the lookup command, like:

[main search] | lookup file.csv fieldname OUTPUT otherfieldnames|...

To write to a lookup you would use outputlookup.

For example:

|inputlookup file.csv|eval cn=if(cn=="something","something else",cn)|outputlookup file.csv

Will perform the lookup, and will change an entry in the field cn if it contains a specific value, and will then overwrite the original lookup (it is always advisable to test the results before performing this overwrite as errors can be embarrassing to fix).

Hope this helps,

Sheamus

View solution in original post

0 Karma

sheamus69
Communicator

If all you want to do is read the contents of the lookup try the inputlookup command.

For example,

|inputlookup file.csv

will list the entire contents of the lookup. You can search for a specific entry in the lookup using:

|inputlookup file.csv | search fieldname=whatever

To perform a lookup against the csv during a search would use the lookup command, like:

[main search] | lookup file.csv fieldname OUTPUT otherfieldnames|...

To write to a lookup you would use outputlookup.

For example:

|inputlookup file.csv|eval cn=if(cn=="something","something else",cn)|outputlookup file.csv

Will perform the lookup, and will change an entry in the field cn if it contains a specific value, and will then overwrite the original lookup (it is always advisable to test the results before performing this overwrite as errors can be embarrassing to fix).

Hope this helps,

Sheamus

0 Karma

sbimizry
Engager

I did it... [main search] | lookup file.csv fieldname OUTPUT otherfieldnames|... ... not worked

0 Karma

sheamus69
Communicator

What specifically are you trying to do with the lookup? Can you give an example?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...