Update Lookup csv by Splunk Output

[RahulMisra1]

How i update the test_MID_IP.csv  with the output IP, so that next time it runs with updated list

index=abc IP!="10.*" [| inputlookup ip_tracking.csv 
  | rename test_DATA AS MID | format ] 
| lookup test_MID_IP.csv test_IP as IP OUTPUT test_IP 
| eval match=if('IP'== test_IP, "yes", "no")
| search match=no 
| stats count by IP

[RahulMisra1]

Thanks. I want to append the IP to the existing lookup 

test_MID_IP.csv

[inventsekar]

Hi @RahulMisra1 

the outputlookup command is used to write the lookup file (we can overwrite or append the lookup file)

Pls note - this one overwrites the lookup file..  if you want to append, pls let us know.. 

index=abc IP!="10.*" 
[| inputlookup ip_tracking.csv | rename test_DATA AS MID | format ] 
| lookup test_MID_IP.csv test_IP as IP OUTPUT test_IP 
| eval match=if('IP'== test_IP, "yes", "no")
| search match=no 
| stats count by IP
| outputlookup test_MID_IP.csv

[yuanliu · Accepted solution]

I think the OP's test_MID_IP.csv contains test_IP, not IP. (Although it doesn't need to be.)  It doesn't need count but may (or may not) need MID.  Also,  the append option is needed for the table preserve all data.

index=abc IP!="10.*" 
[| inputlookup ip_tracking.csv | rename test_DATA AS MID | format ] 
| lookup test_MID_IP.csv test_IP as IP OUTPUT test_IP 
| where isnull(test_IP)
| dedup IP
| rename IP as test_IP
| fields test_IP MID ``` omit MID if that's not needed ```
| outputlookup append=true test_MID_IP.csv