Splunk Search

how to add a new column to existing inputlookup

james_n
Path Finder

Hi Experts,

Hi have existing inputlookup file like test.csv which contains 3 fields like host source sourcetype, i want to add extra one new filed called _time with these 3 fields. I have tried with basesearch | table host source soursetype _time|outputlookup test.csv append=true but new field is not appending

for example if I have this existing csv file contains 100 rows, then these 3 fileds along with new filed results shold be added from 101th row onwards in the csv. Plz help on this and thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need to re-write the entire CSV so the header has the new field name.

| inputlookup test.csv
| append [ basesearch ]
| dedup host source sourcetype
| table host source sourcetype _time
| outputlookup test.csv

The dedup command presumes you want unique tuples in your lookup file. If that's not the case, remove dedup.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...