Splunk Search

how to add a new column to existing inputlookup

james_n
Path Finder

Hi Experts,

Hi have existing inputlookup file like test.csv which contains 3 fields like host source sourcetype, i want to add extra one new filed called _time with these 3 fields. I have tried with basesearch | table host source soursetype _time|outputlookup test.csv append=true but new field is not appending

for example if I have this existing csv file contains 100 rows, then these 3 fileds along with new filed results shold be added from 101th row onwards in the csv. Plz help on this and thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need to re-write the entire CSV so the header has the new field name.

| inputlookup test.csv
| append [ basesearch ]
| dedup host source sourcetype
| table host source sourcetype _time
| outputlookup test.csv

The dedup command presumes you want unique tuples in your lookup file. If that's not the case, remove dedup.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...