Splunk Search

Splunk query to Append/replace the specific fields in the lookup file (csv)

mala_splunk_91
Explorer

Hi, 

I  have a lookup file with the fields - biz_department, biz_unit, biz_owner, data_usage

I have a query to generate the "datausage" values based on biz_unit. I will schedule the report so that it will update only the "data_usage" values in the lookup file periodically.

How can i call the lookupfile and update only specific field?

Thanks

MS

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to replace individual fields of a lookup file.  The entire file must be replaced or appended.

Usually, the lookup file is read, updates are made, and then the file is rewritten.

| <<your datausage query>>
| append [ inputlookup mylookupfile.csv ]
```Save only the newest events (from the query)```
| dedup biz_department, biz_unit, biz_owner
| outputlookup mylookupfile.csv
---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...