Splunk Search

Splunk query to edit lookup file

New Member

Hi Guys,

I have a .csv lookup file that maintain the 'inactive' accounts list. can anyone help me with a query to remove one of the username from the list?

Labels (1)
0 Karma


The easiest way to edit a lookup file is with the Lookup File Editor app (https://splunkbase.splunk.com/app/1724).

If you're trying to edit the file within a search, know that regular lookup files can't be edited.  You must replace the entire file.

If this reply helps you, an upvote would be appreciated.
0 Karma