Splunk Search

Updating one Field in a lookup table

MoeTaher
Observer

Hello All, 

I'm having a task to measure the compliancy of Security solution onboarded on the SIEM, that means i have to regularly check if the solution is onboarded by checking if there is any logs generating in a specific index, 

For Example my search query will be :

index=EDR
| stats count
| eval status=if((count > "0"),"Compliant","Not Compliant")
| fields -count

Results that i should have:

status
Compliant

 

I have a lookup table called compliance.csv and i need to update the status from "Not Compliant" to "Compliant". 

Solution Status
EDR Not Compliant
DLP Not Compliant

 

how can i utilize outputlookup command to update the table not overwrite or append. 

 

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Rather than using the subsearch syntax with append

| append [ 
  | inputlookup ...
]

use the native

| inputlookup append=t

which has no subsearch limitations. You also don't need the redundant fields command as it will be removed with the stats, so 

index=EDR
| stats count
| eval Status=if((count > "0"),"Compliant","Not Compliant"), Solution="EDR"
| inputlookup append=t compliance.csv
| stats first(Status) AS Status BY Solution
| outputlookup compliance.csv

 

PickleRick
SplunkTrust
SplunkTrust

Depends on the lookup type. If your lookup is a csv-file based one, you can't update it. The only thing you can do, as was shown by @gcusello , is to overwrite whole lookup with updated contents.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MoeTaher ,

please try something like this:

index=EDR
| stats count
| eval Status=if((count > "0"),"Compliant","Not Compliant"), Solution="EDR"
| fields -count
| appemd [ | inputlookup compliance.csv | fields Solution Status ]
| stats first(Status) AS Status BY Solution
| outputlookup compliance.csv

Ciao.

Giuseppe

marnall
Motivator

@gcusello has a good solution but mind the typos: (space in fields cmd and "append")

...
| fields - count
| append [ | inputlookup compliance.csv | fields Solution Status ]
...

 

gcusello
SplunkTrust
SplunkTrust

Hi @MoeTaher ,

yes correct (I'm sorry!):

index=EDR
| stats count
| eval Status=if((count > "0"),"Compliant","Not Compliant"), Solution="EDR"
| fields - count
| append [ | inputlookup compliance.csv | fields Solution Status ]
| stats first(Status) AS Status BY Solution
| outputlookup compliance.csv

 Ciao.

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...