How to update a lookup file with top command results?

[srinivasup]

Hi,

I have lookup file with host and count fields as below

host.csv

host  count
-----------------
host1 10
host2 20
host3 30
host4 40
host5 50
host6 60
host7 70

Now i will get top 5 host counts from log events as below

index=main | top 5 host | table host count.

result:

host1 2
host2 3
host3 4
host4 5
host5 6

Now i want to update these top command results in csv and sum them and get final top 5 host count.
Final output should be in lookup file for further usage:

host   count
-----------------
host1 12
host2 23
host3 34
host4 45
host5 56
host6 60
host7 70

[niketn]

@srinivasup... Were you able to try out any one of the following options?

[woodcock]

Like this:

index=main | top 5 host | table host count | appendpipe [|inputcsv host.csv] | stats sum(count) AS count BY host | outputcsv host.csv

[niketn]

Try something like following with accum. Streamstats will also allow you to achieve the same.

index=main [inputlookup host.csv | table sourcetype]
| lookup host.csv host OUTPUT count as csvCount
| stats count as indexCount values(csvCount) as csvCount by sourcetype
| sort -indexCount 
| eval counter=1
| accum counter
| eval count=if(counter<=5,indexCount+csvCount,csvCount)
| table sourcetype count
| outputlookup host.csv