Splunk Search

Replacing values in a column in a lookup table with the results from a search query?

loki
New Member

Hi,

I have been tasked to design an alert to trigger whenever there is a modification of the "search query" of an alert. To achieve this, I have decided to use the following approach:
1.compute the hash value of the search    2.create a lookup table (say, search_hash.csv)   3.and then compute the hash of the search (say every 24hr)     4.and now compare the computed hash against the already existing hash in the lookuptable     5.and if there is a difference, then REPLACE the value in the original lookup file search_hash.csv. with the dynamically computed value. 

I have been able to reach step 4, but stuck at STEP 5. Please can some help me how I can achieve the last step of DYNAMICALLY REPLACING VALUES OF A LOOKUP WITH SEARCH RESULTS.?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't replace individual values of a lookup file.  You have to re-write the whole thing.

| inputlookup mylookup.csv
```make some changes```
| outputlookup mylookup.csv

An alternative is to use a KVstore collection for the hashes.  Those can be updated individually.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...