Splunk query to Append/replace the specific fields in the lookup file (csv)

[mala_splunk_91]

Hi, 

I  have a lookup file with the fields - biz_department, biz_unit, biz_owner, data_usage

I have a query to generate the "datausage" values based on biz_unit. I will schedule the report so that it will update only the "data_usage" values in the lookup file periodically.

How can i call the lookupfile and update only specific field?

Thanks

MS

[richgalloway]

It's not possible to replace individual fields of a lookup file.  The entire file must be replaced or appended.

Usually, the lookup file is read, updates are made, and then the file is rewritten.

| <<your datausage query>>
| append [ inputlookup mylookupfile.csv ]
```Save only the newest events (from the query)```
| dedup biz_department, biz_unit, biz_owner
| outputlookup mylookupfile.csv