Getting Data In

Update only specific field in csv

AKG1_old1
Builder

Hi,

I am running a search query which take input from lookup and generate counts for each row. And I want to update only specific column "No_Of_MXTIMING_Events" in the csv. It should't change the row count and I don't want to rewrite full csv again.

Query to generate "No_Of_MXTIMING_Events"

| inputlookup Test_Row_Count.csv | where isnull(No_TPS_Events) OR isnull(No_TPS_Events)
| eval Start_epoc=Start 
| eval Stop_epoc=Stop 
| table ID, Start_epoc , Stop_epoc, Host 
| map maxsearches=1001 search="| tstats summariesonly=true count(MXTIMING.Elapsed) as No_Of_MXTIMING_lines FROM datamodel=MXTIMING_V8 WHERE 
    host=$Host$ earliest=$Start_epoc$ latest=$Stop_epoc$  | eval ID=\"$ID$\" | eval Host=\"$Host$\" " 
| sort 0 - by ID 
| table ID, Host, No_Of_MXTIMING_lines

alt text

0 Karma

xpac
SplunkTrust
SplunkTrust

Simply put, you can't. KV Store lookups allow to only update certain records, but CSV lookups can only be written as a whole.
You therefore have to do | inputlookup, then do your change, and then do | outputlookup so all data is written back to the lookup.

You could however replace | table in your example with | fields. The | table command is only used for graphical representation, and is considerably slower than | fields, although it has the same effect in your use case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...