Splunk Search

How to update only the last row of a table lookup dynamically

lufermalgo
Path Finder

Hello community,

I have a lookup cn two fields, _time and count per day. I need to update each time the record of the current day without affecting the previous days as the days can not see again.

alt text

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search to get the count and ran for today i.e. earliest=@d latest=now | timechart span=1d count 
| inputlookup yourlookup.csv append=t | stats max(count) as count by _time | outputlookup yourlookup.csv

So, every time you run this search for time range today, it will recalculate count for today, merge it with current lookup values and takes the highest count for today (every day but since you're updating today's count only, remaining day's count will remain unchanged), which should be higher in the latest run.

View solution in original post

gokadroid
Motivator

Try this:

|inputlookup yourCsvOrLookupTableFileName append=t
|append [ search yoursearch that gets you the values the way in screenshot | tail 1 ]
| outputlookup yourCsvOrLookupTableFileName

Example for me was:

  |inputlookup ipVal.csv append=t 
  |append [search index=main sid="grass" |mySearch| tail 1 ]
  | outputlookup ipVal.csv

somesoni2
Revered Legend

Try like this

your current search to get the count and ran for today i.e. earliest=@d latest=now | timechart span=1d count 
| inputlookup yourlookup.csv append=t | stats max(count) as count by _time | outputlookup yourlookup.csv

So, every time you run this search for time range today, it will recalculate count for today, merge it with current lookup values and takes the highest count for today (every day but since you're updating today's count only, remaining day's count will remain unchanged), which should be higher in the latest run.

Get Updates on the Splunk Community!

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...