How to write lookup csv file?

[vikas_gopal]

Hi Splunk Experts,

I am preparing one POC , here what I want .

I have data in splunk like (empId,name,deparment) . I have prepared csv lookup and csv has (empid , salary) columns . What I want is to write back the csv file and add only those employees which does not exist and ignore if empid exists. For example

Splunk Data is
empId,name,deparment,salary
1,vg,finance,10$
2,gv,it,20$
3,abc,IT,30$

lookup file
empId,Salary
1,10$
2,20$

Now I want to update csv using outputlookup command , but only for empid 3 . Please suggest how I can achieve this .

So my outputlookup csv should look like
empId,Salary
1,10$
2,20$
3,30$

Reagrds
VG

[elliotproebstel · Accepted solution]

If you have a search that returns only the item you want to append to the lookup file, you can add that event via:

your search that returns only events that aren't yet in the file
| outputlookup append=true my_lookup.csv

If your search returns more items than just the one that's currently not present in the file and you want to make sure you only add the new ones, one way to get them both into the file without duplicates is:

your search that returns events that may or may not already be in the file
| lookup my_lookup.csv empId OUTPUT empId AS found_empId
| where isnull(found_empId)
| outputlookup append=true my_lookup.csv

There are a handful of approaches to the second option; this is only one. The approaches would vary in efficiency based on the size of your data set and the frequency with which you'll be updating the lookup.