Splunk Search

Rename a field Value in a lookup file?

iamsplunker31
Path Finder

I have a lookup file called template.csv and it has field values, I want to rename a field value with another say mango to banana. how can we do ?

Also If I want to replace the field values in 2 lookupfiles in template.csv and template2.csv rename field value with mango to banana .Can we do in one query?

0 Karma
1 Solution

darrenfuller
Contributor

To replace all values in fieldname from mango to banana, use something like:

| inputlookup template.csv
| eval fieldname=if(fieldname="mango", "banana", fieldname)
| outputlookup template.csv

and no... you would need to do this in two queries.

View solution in original post

0 Karma

darrenfuller
Contributor

To replace all values in fieldname from mango to banana, use something like:

| inputlookup template.csv
| eval fieldname=if(fieldname="mango", "banana", fieldname)
| outputlookup template.csv

and no... you would need to do this in two queries.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...