Splunk Search

How to read content of refreshed csv file via lookup

Engager

Hi, i have configured a csv lookup in splunk. Now i want to change the content of csv file so that it gets updated in splunk lookup search. Is there a way to this

0 Karma

Communicator

Hi,

There are few ways to perform this,

  1. Convert your file based lookup to kvstore, which helps you to change the content easy (https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/ConfigureKVstorelookups)
  2. Use lookup editor app to modify contents in the lookup (https://splunkbase.splunk.com/app/1724/)
  3. Write a search to modify the contents and update the samelookup |inputlookup abc.csv | <content modify search> | outputlookup abc.csv Your <content modify search> can be something like |eval <fieldname>=if(fieldname=="something","newvalue","oldvalue") etc., to update field such as fieldname values with the new content. Above logic varies based on your requirement, please check eval documentation here (https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/CommonEvalFunctions)
0 Karma

Engager

Thanks. My objective over here is that i am having some static content which i am loading into the csv file and then reading it using inputlookup. After updating the content curently i have to replace the file in splunk back again.

0 Karma

Communicator

@sudeep5689 Yes, may be 2nd option or 3rd option works for you.
If my solution helps, please mark it as answered

0 Karma