Hi all,
I am looking to have a csv with a number of rows and columns. I would like that when the CSV gets updated e.g. with new field that the query is run and then the output is put into a new column field (status) in that row to be changed to e.g. status "Detected"
Does this make sense ? Has anyone the 1,2,3 steps please? thanks in advance.
Hi colinmchugo, the basic process of updating a CSV based lookup is to '| inputlookup' the CSV in question, modify the values as desired with eval and other searchtime field manipulating commands, and then '| outputlookup' back to the same CSV to commit the changes.
If you'd like to have more featureful datastore, you can utilize KVStore collections http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZK
This allows for direct update of specific fields, without rewriting the whole lookup.
Please let me know if this answers your question!