Splunk query to edit lookup file

[sahilarora]

Hi Guys,

I have a .csv lookup file that maintain the 'inactive' accounts list. can anyone help me with a query to remove one of the username from the list?

[richgalloway]

The easiest way to edit a lookup file is with the Lookup File Editor app (https://splunkbase.splunk.com/app/1724).

If you're trying to edit the file within a search, know that regular lookup files can't be edited.  You must replace the entire file.