update old values in lookup table and add new rows to the table

[avi123]

Hi All,

I have created a lookup table Status.csv which is having all the status of tickets and whether they are SLA relevant or not. However, due to having incorrect data while creating the table the values for all the Statuses are coming wrong. I want to update all the data for these statuses and add few more status values to the lookup table. How do I do that? Please suggest.

[Temuulen0303]

You can fetch results of lookup using search:
| inputlookup your_lookup.csv

Replacing lookup data would be:
```your search here```
| outputlookup your_lookup.csv

And then you can add(append) rows using:
```your search here```
| outlookup append=true your_lookup.csv

[richgalloway]

If the lookup table is small enough, you may be able to update it manually using the Splunk App for Lookup File Editing (https://splunkbase.splunk.com/app/1724).

Otherwise, the only way to do it in SPL is to read the entire lookup table, modify the status field using eval or other commands, and then rewrite the lookup table.

| inputlookup Status.csv
| eval status=...
| outputlookup Status.csv