How to update a new row in lookup file using eval command or some other command?

[Rajiv_splunk]

Hello everyone,

I have a lookup file which have 5 entry with filed name and field value as below

"New_field"="yes", New_field1="yes", "New_field3"="yes", New_field4="Yes"

I need to append a new row to the lookup file with all the field value as "No". I am using the below command to do this

|inputlookup sample_demo.csv
|append [|inputlookup sample_demo.csv|eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]

this query is adding the new row but its adding 5 new row... I just need one row to append with new field value as "no"

Can anyone please guide me on this, as what am i missing in the query

[Rajiv_splunk]

i got it fixed...run the eval command again...Thanks 

[Rajiv_splunk]

I got stuck in an another issue..how would i add multiple rows in lookup file through query if only one field vlaue i have to change. say i also have to add all the field value as "yes" and all the field value as "accepted"

[richgalloway · Accepted solution]

There's no need to re-read the lookup file in the append.  Just append the new fields and write the whole thing back to the lookup.

|inputlookup sample_demo.csv
|append [ | makeresults 
  |eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]
| outputlookup sample_demo.csv

You also can do it without reading the lookup.

| makeresults
| eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"
| table New_field, New_field1, New_field2, New_field3, New_field4
| outputlookup append=1 sample_demo.csv

[Rajiv_splunk]

Thanks  a ton @richgalloway for your quick reply.  It works like a charm 🙂