Splunk Search

How to update particular row of existing lookup csv ?

patra966
Path Finder

I have existing lookup csv. I want to update a row with new value.
ID Name Location
549 Test_1 Bangalore
549 Test_2 Delhi
729 Test_3 Mumbai
549 Test_4 Bangalore
729 Test_5 Bangalore

Test_4 will be replace with Test_8 and my lookup table will be look like as below

ID Name Location
549 Test_1 Bangalore
549 Test_2 Delhi
729 Test_3 Mumbai
549 Test_8 Bangalore
729 Test_5 Bangalore

How can I achieve it through search query.

Regards
Raja

Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The basic approach is to read in the CSV file, change what needs to be changed, and then re-write the file.

| inputlookup my.csv
| eval Name = if(Name=="Test_4", "Test_8", Name)
| outputlookup my.csv
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The basic approach is to read in the CSV file, change what needs to be changed, and then re-write the file.

| inputlookup my.csv
| eval Name = if(Name=="Test_4", "Test_8", Name)
| outputlookup my.csv
---
If this reply helps you, Karma would be appreciated.

patra966
Path Finder

Let consider another scenario.

If my Name column suppose to be "Test Name".

Case-1:

| inputlookup my.csv
| eval "Test Name" = if("Test Name"=="Test_4", "Test_8", "Test Name")
| outputlookup my.csv

For this I am getting like below:
ID Test Name Location
549 Test Name Bangalore
549 Test Name Delhi
729 Test Name Mumbai
549 Test Name Bangalore
729 Test Name Bangalore

Case- 2:

| inputlookup my.csv
| eval Test Name = if(Test Name=="Test_4", "Test_8", Test Name)
| outputlookup my.csv
Getting error for this.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...