Splunk Search

How to update only the last row of a table lookup dynamically

lufermalgo
Path Finder

Hello community,

I have a lookup cn two fields, _time and count per day. I need to update each time the record of the current day without affecting the previous days as the days can not see again.

alt text

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search to get the count and ran for today i.e. earliest=@d latest=now | timechart span=1d count 
| inputlookup yourlookup.csv append=t | stats max(count) as count by _time | outputlookup yourlookup.csv

So, every time you run this search for time range today, it will recalculate count for today, merge it with current lookup values and takes the highest count for today (every day but since you're updating today's count only, remaining day's count will remain unchanged), which should be higher in the latest run.

View solution in original post

gokadroid
Motivator

Try this:

|inputlookup yourCsvOrLookupTableFileName append=t
|append [ search yoursearch that gets you the values the way in screenshot | tail 1 ]
| outputlookup yourCsvOrLookupTableFileName

Example for me was:

  |inputlookup ipVal.csv append=t 
  |append [search index=main sid="grass" |mySearch| tail 1 ]
  | outputlookup ipVal.csv

somesoni2
Revered Legend

Try like this

your current search to get the count and ran for today i.e. earliest=@d latest=now | timechart span=1d count 
| inputlookup yourlookup.csv append=t | stats max(count) as count by _time | outputlookup yourlookup.csv

So, every time you run this search for time range today, it will recalculate count for today, merge it with current lookup values and takes the highest count for today (every day but since you're updating today's count only, remaining day's count will remain unchanged), which should be higher in the latest run.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!