Splunk Search

Replacing values in a column in a lookup table with the results from a search query?

loki
New Member

Hi,

I have been tasked to design an alert to trigger whenever there is a modification of the "search query" of an alert. To achieve this, I have decided to use the following approach:
1.compute the hash value of the search    2.create a lookup table (say, search_hash.csv)   3.and then compute the hash of the search (say every 24hr)     4.and now compare the computed hash against the already existing hash in the lookuptable     5.and if there is a difference, then REPLACE the value in the original lookup file search_hash.csv. with the dynamically computed value. 

I have been able to reach step 4, but stuck at STEP 5. Please can some help me how I can achieve the last step of DYNAMICALLY REPLACING VALUES OF A LOOKUP WITH SEARCH RESULTS.?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't replace individual values of a lookup file.  You have to re-write the whole thing.

| inputlookup mylookup.csv
```make some changes```
| outputlookup mylookup.csv

An alternative is to use a KVstore collection for the hashes.  Those can be updated individually.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...