Is it possible to modify a portion of CSV file in inputlookup?

[majilan1]

Hi Every one,

Is it possible to modify a portion of CSV file in inputlookup?

Cheers.

[bowesmana]

Are you looking to read the CSV, make some modifications and save it back again? If so, 2 approaches.

The first is to simply input, change as needed and then output, e.g.

| inputlookup your.csv
| eval field_value=if(field_value="I want this field", "change me", field_value)
| outputlookup your.csv

or you can use the lookup editor to manually edit the lookup

https://splunkbase.splunk.com/app/1724/

[majilan1]

Thanks bowesmana,

[bowesmana]

this should do it

REMEMBER:   if you plan to do this automatically - please make sure you have a backup copy of the original in case you get the SPL wrong first time!!!

| inputlookup host_blackout.csv
| eval end_time=if(host IN ("mep1", "mep2", "mep3"), "08/28/2022 11:00", end_time)
| oututlookup host_blackout.csv

It sounds like you could also use the eval function 'relative_time()' to calculate the 'end of next week', e.g. like this

| inputlookup host_blackout.csv
| eval end_time=if(host IN ("mep1", "mep2", "mep3"), 
            strftime(relative_time(now(), "+2w@w7+11h"), "%m/%d/%Y %H:%M"),
            end_time)
| oututlookup host_blackout.csv

which would make it 11am on Sunday in the week following

[majilan1]

I get error in 'EvalCommand': the expression is malformed. Expected).

[bowesmana · Accepted solution]

The eval 'case' statement was meant to be an 'if'. Fixed