Splunk Search
Highlighted

How to read content of refreshed csv file via lookup

Engager

Hi, i have configured a csv lookup in splunk. Now i want to change the content of csv file so that it gets updated in splunk lookup search. Is there a way to this

0 Karma
Highlighted

Re: How to read content of refreshed csv file via lookup

Path Finder

Hi,

There are few ways to perform this,

  1. Convert your file based lookup to kvstore, which helps you to change the content easy (https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/ConfigureKVstorelookups)
  2. Use lookup editor app to modify contents in the lookup (https://splunkbase.splunk.com/app/1724/)
  3. Write a search to modify the contents and update the samelookup |inputlookup abc.csv | <content modify search> | outputlookup abc.csv Your <content modify search> can be something like |eval <fieldname>=if(fieldname=="something","newvalue","oldvalue") etc., to update field such as fieldname values with the new content. Above logic varies based on your requirement, please check eval documentation here (https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/CommonEvalFunctions)
0 Karma
Highlighted

Re: How to read content of refreshed csv file via lookup

Engager

Thanks. My objective over here is that i am having some static content which i am loading into the csv file and then reading it using inputlookup. After updating the content curently i have to replace the file in splunk back again.

0 Karma
Highlighted

Re: How to read content of refreshed csv file via lookup

Path Finder

@sudeep5689 Yes, may be 2nd option or 3rd option works for you.
If my solution helps, please mark it as answered

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.