How to update only the last row of a table lookup dynamically

[lufermalgo]

Hello community,

I have a lookup cn two fields, _time and count per day. I need to update each time the record of the current day without affecting the previous days as the days can not see again.

[gokadroid]

Try this:

|inputlookup yourCsvOrLookupTableFileName append=t
|append [ search yoursearch that gets you the values the way in screenshot | tail 1 ]
| outputlookup yourCsvOrLookupTableFileName

Example for me was:

  |inputlookup ipVal.csv append=t 
  |append [search index=main sid="grass" |mySearch| tail 1 ]
  | outputlookup ipVal.csv

[somesoni2 · Accepted solution]

Try like this

your current search to get the count and ran for today i.e. earliest=@d latest=now | timechart span=1d count 
| inputlookup yourlookup.csv append=t | stats max(count) as count by _time | outputlookup yourlookup.csv

So, every time you run this search for time range today, it will recalculate count for today, merge it with current lookup values and takes the highest count for today (every day but since you're updating today's count only, remaining day's count will remain unchanged), which should be higher in the latest run.