How to replace a field value in a static lookup in Splunk using Splunk search query

[MousumiChowdhur]

Hello everyone!

I have a static lookup which has two fields/columns State and tag. Default value of State is "Enabled" for all the tags as mentioned below.

    tag           State
    platformA     Enabled
    platformB     Enabled
    platformC     Enabled
    platformD     Enabled

I want to give the capability to user to alter the State of tag to "Disabled" as and when required.
So basically they would be altering this static lookup and dump the modified result to the same lookup as mentioned below.

    tag           State
    platformA     Disabled
    platformB     Enabled
    platformC     Enabled
    platformD     Enabled

I am able to replace the State in my search but if I do append after outputlookup then it appends a new record and if I don't do append then it deletes all other existing records and keep only the newly replaced record.

I have tried with below two queries:

Query 1-

| inputlookup tags.csv where tag=platformA | replace "Disabled" with "Enabled" in State | outputlookup append=t tags.csv

Query 2-

| inputlookup tags.csv where tag=platformA | replace "Disabled" with "Enabled" in State | outputlookup tags.csv

Am I missing anything? Or is there a better approach to this?

Thanks in advance.

[gcusello]

Hi @MousumiChowdhury,
in situations like the one you described, I usually prefer to use the Lookup File Editor app tha you can find at https://splunkbase.splunk.com/app/1724/ .

Ciao.
Giuseppe