Splunk Search

Rename a field Value in a lookup file?

iamsplunker31
Path Finder

I have a lookup file called template.csv and it has field values, I want to rename a field value with another say mango to banana. how can we do ?

Also If I want to replace the field values in 2 lookupfiles in template.csv and template2.csv rename field value with mango to banana .Can we do in one query?

0 Karma
1 Solution

darrenfuller
Contributor

To replace all values in fieldname from mango to banana, use something like:

| inputlookup template.csv
| eval fieldname=if(fieldname="mango", "banana", fieldname)
| outputlookup template.csv

and no... you would need to do this in two queries.

View solution in original post

0 Karma

darrenfuller
Contributor

To replace all values in fieldname from mango to banana, use something like:

| inputlookup template.csv
| eval fieldname=if(fieldname="mango", "banana", fieldname)
| outputlookup template.csv

and no... you would need to do this in two queries.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...