Hi Guys,
I have a .csv lookup file that maintain the 'inactive' accounts list. can anyone help me with a query to remove one of the username from the list?
The easiest way to edit a lookup file is with the Lookup File Editor app (https://splunkbase.splunk.com/app/1724).
If you're trying to edit the file within a search, know that regular lookup files can't be edited. You must replace the entire file.