Hi guys,
I was wondering if anyone knew of a method of appending data to a lookup, but not overwriting anything in the lookup AND also not adding duplicate data entries into the lookup?
Any suggestions would be helpful.
Cheers,
Robbie
| inputlookup <table>
| append [makeresults | eval .... | fields - _time]
| dedup <keyfield>
| outputlookup <table> append=false
Another way to do it:
| inputlookup <table>
| append [makeresults | eval .... | fields - _time]
| dedup <keyfield>
| outputlookup <table> append=false