Splunk Search

How to replace a field value in a static lookup in Splunk using Splunk search query

MousumiChowdhur
Contributor

Hello everyone!

I have a static lookup which has two fields/columns State and tag. Default value of State is "Enabled" for all the tags as mentioned below.

    tag           State
    platformA     Enabled
    platformB     Enabled
    platformC     Enabled
    platformD     Enabled

I want to give the capability to user to alter the State of tag to "Disabled" as and when required.
So basically they would be altering this static lookup and dump the modified result to the same lookup as mentioned below.

    tag           State
    platformA     Disabled
    platformB     Enabled
    platformC     Enabled
    platformD     Enabled

I am able to replace the State in my search but if I do append after outputlookup then it appends a new record and if I don't do append then it deletes all other existing records and keep only the newly replaced record.

I have tried with below two queries:

Query 1-

| inputlookup tags.csv where tag=platformA | replace "Disabled" with "Enabled" in State | outputlookup append=t tags.csv

Query 2-

| inputlookup tags.csv where tag=platformA | replace "Disabled" with "Enabled" in State | outputlookup tags.csv

Am I missing anything? Or is there a better approach to this?

Thanks in advance.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MousumiChowdhury,
in situations like the one you described, I usually prefer to use the Lookup File Editor app tha you can find at https://splunkbase.splunk.com/app/1724/ .

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...