×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
justinchen
Explorer
Member since: ‎11-17-2019
‎07-16-2020
Community Statistics
Posts 3
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎11-17-2019
View All

Re: How to update a lookup table with certain fiel...

by in Splunk Search
‎07-16-2020 07:35 PM
‎07-16-2020 07:35 PM
I have tuned the SPL with: | tstats count as totalCount earliest(_time) as firstTime latest(_time) as lastTime where index!="main" by index host | join overwrite=t type=outer [inputlookup nonforwarderhost.csv | fields index host accepted_delta is_expected] | fields index host firstTime lastTime totalCount accepted_delta is_expected | fillnull value=1000000000 accepted_delta | fillnull value="FALSE" is_expected | outputlookup nonforwarderhost.csv   And now this is working as expected. 😀 ... View more

Re: How to update a lookup table with certain fiel...

by in Splunk Search
‎07-16-2020 06:23 PM
‎07-16-2020 06:23 PM
  Thanks you @gcusello  that you pointed out my error in the SPL. I have edited that. Yet this still update the filelds with my custom values with column(accepted_delta and is_expected). I will keep this question to you and myself. I am certain is doable but need some effort to find out how. 🙂   ... View more

How to update a lookup table with certain fields b...

by in Splunk Search
‎07-16-2020 01:10 AM
‎07-16-2020 01:10 AM
Hi There, I have a lookup table that generate one lookup table yet it has some custom column that do not have values by default, and I add custom values to them. The columns which I want to update by SPL are host index firstTime lastTime totalCount   The columns which I want to update their values manually are: accepted_delta is_expected   Below is a screenshot of this table. Currently we are using the following daily SPL to update this table, but I am really bad at SPL, the bug is that it will just overwrite everything that in this lookup table and all my custom values (columns of accepted_delta, is_expected) all gone. | tstats count as totalCount earliest(_time) as firstTime latest(_time) as lastTime where index!="main" by index host | fields host index firstTime lastTime totalCount accepted_delta is_expected | fillnull value=1000000000 accepted_delta | fillnull value="false" is_expected | outputlookup  nonforwarderhost.csv   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎07-16-2020 11:28 PM