Splunk Search

How to update a new row in lookup file using eval command or some other command?

Rajiv_splunk
Path Finder

Hello everyone,

I have a lookup file which have 5 entry with filed name and field value as below

"New_field"="yes", New_field1="yes", "New_field3"="yes", New_field4="Yes"

I need to append a new row to the lookup file with all the field value as "No". I am using the below command to do this

|inputlookup sample_demo.csv
|append [|inputlookup sample_demo.csv|eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]

this query is adding the new row but its adding 5 new row... I just need one row to append with new field value as "no"

Can anyone please guide me on this, as what am i missing in the query

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There's no need to re-read the lookup file in the append.  Just append the new fields and write the whole thing back to the lookup.

|inputlookup sample_demo.csv
|append [ | makeresults 
  |eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]
| outputlookup sample_demo.csv

You also can do it without reading the lookup.

| makeresults
| eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"
| table New_field, New_field1, New_field2, New_field3, New_field4
| outputlookup append=1 sample_demo.csv
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Rajiv_splunk
Path Finder

i got it fixed...run the eval command again...Thanks 

0 Karma

Rajiv_splunk
Path Finder

I got stuck in an another issue..how would i add multiple rows in lookup file through query if only one field vlaue i have to change. say i also have to add all the field value as "yes" and all the field value as "accepted"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no need to re-read the lookup file in the append.  Just append the new fields and write the whole thing back to the lookup.

|inputlookup sample_demo.csv
|append [ | makeresults 
  |eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]
| outputlookup sample_demo.csv

You also can do it without reading the lookup.

| makeresults
| eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"
| table New_field, New_field1, New_field2, New_field3, New_field4
| outputlookup append=1 sample_demo.csv
---
If this reply helps you, Karma would be appreciated.

Rajiv_splunk
Path Finder

Thanks  a ton @richgalloway for your quick reply.  It works like a charm 🙂

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...