Hi,
I am running a search query which take input from lookup and generate counts for each row. And I want to update only specific column "No_Of_MXTIMING_Events" in the csv. It should't change the row count and I don't want to rewrite full csv again.
Query to generate "No_Of_MXTIMING_Events"
| inputlookup Test_Row_Count.csv | where isnull(No_TPS_Events) OR isnull(No_TPS_Events)
| eval Start_epoc=Start
| eval Stop_epoc=Stop
| table ID, Start_epoc , Stop_epoc, Host
| map maxsearches=1001 search="| tstats summariesonly=true count(MXTIMING.Elapsed) as No_Of_MXTIMING_lines FROM datamodel=MXTIMING_V8 WHERE
host=$Host$ earliest=$Start_epoc$ latest=$Stop_epoc$ | eval ID=\"$ID$\" | eval Host=\"$Host$\" "
| sort 0 - by ID
| table ID, Host, No_Of_MXTIMING_lines
Simply put, you can't. KV Store lookups allow to only update certain records, but CSV lookups can only be written as a whole.
You therefore have to do | inputlookup
, then do your change, and then do | outputlookup
so all data is written back to the lookup.
You could however replace | table
in your example with | fields
. The | table
command is only used for graphical representation, and is considerably slower than | fields
, although it has the same effect in your use case.