Splunk Dev

Is there a way to look at CSV files in the lookup ?

jhartm5
New Member

I created a lookup as a CSV and want to view the contents of the CSV in Splunk. Is there an easy way to accomplish this? I can use the CSV but if I want to look at the contents of the CSV And If I want to edit the CSV I usually delete the CSV and add new. Is there a better way to update the CSV file?

Tags (1)
0 Karma
1 Solution

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

View solution in original post

0 Karma

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

0 Karma

jhartm5
New Member

Thanks for the additional details.

0 Karma

chasrini
New Member

Hi - I am looking to download a inputlookup csv file but I am not able to do that. Is there a way to do that. Thanks.

0 Karma

ssadanala1
Contributor

To view the content of the csv please run

|inputlookup lookupname.csv in the search bar .

If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .

https://splunkbase.splunk.com/app/1724/

jhartm5
New Member

Thanks for getting back so quickly. This worked.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...