Splunk Search

How do you append new results in a lookup file?

chanthongphiob
Path Finder

I have a lookup table that runs every month of previous successful logins. For example:

Account_Name, Host
alpha, comp1 comp2 comp3
bravo, comp1 comp3
charlie, comp2

Now I have a scheduled report to run daily to determine any differences between the lookup file and account names and hosts of new daily logons. So, for example, if the new data is...

Account_Name, Host
alpha, comp4
alpha, comp5
bravo, comp2
charlie, comp1

I want my new lookup table to compensate for this. New result set will be as follow:
Account_Name, Host
alpha, comp1 comp2 comp3 comp4 comp5
bravo, comp1 comp2 comp3
charlie, comp1 comp2

How do I write the outputlookup portion to append the new data to the old data in the lookup file?

My query is as follow to obtain new data:
index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host

1 Solution

493669
Super Champion

Hi @chanthongphiob,
Try this:

index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv

View solution in original post

0 Karma

493669
Super Champion

Hi @chanthongphiob,
Try this:

index=main NOT [ | inputlookup baseline.csv ] | table Account_Name Host| outputlookup append=true newlookup.csv
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Are you guys sure of this method with tstats? 

| tstats count where (index=test* earliest="2/1/2020:00:00:00" latest="3/1/2020:00:00:00") BY _time span=1d 
| inputlookup append=true testlookup.cvs
| outputlookup testlookup.csv

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jameswatts
Explorer

search blah | inputlookup append=true X.cvs | outputlookup X.csv

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...