How to add a new row to a lookup using a Splunk query?

[agentsofshield]

Is there a Splunk query to add a new row or a new column to a lookup table?

I specifically ask for a query because I want my Python script to append rows automatically.

Thanks.

[nickhills]

One approach, which I find most robust is:

1.) Open your original lookup.
2.) Table your new row
3.) Dedup (if necessary)
4.) Write the updated lookup

 [your search which produces results of 1 or more rows]
| inputlookup append=true mylookup.csv
|table field_id, field_a, field_b
|dedup field_id
|outputlookup mylookup.csv

Using this method you can add both rows and columns if needed by including them in the table command. This will load the 'old copy' of the file, and re-write the file with all the rows/columns present in the table.

[agentsofshield]

But I'm not taking my new values from a Splunk search. It's from a Python script. How do I just put specific values in the lookup?

[nickhills]

A python script running outside of splunk?
If so, you just need to configure the script to write a new line (and optionally a header if you're adding new cols) to the csv in the lookups directory, but you will want to include error handling etc to make sure you don't trash the original file.

[harsmarvania57 · Accepted solution]

Hi,

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>

OR

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

[agentsofshield]

How do I "make results"?

[harsmarvania57]

As you are using python so first create splunk query using python, if you want to add more results then you can do something like this while creating query.

Create variable called ip and with all values delimited with semicolon so something like this ip="3.4.5.6;10.10.0.1" and then use below splunk query

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="3.4.5.6;10.10.0.1" ]
| table ip
| eval ip=split(ip,";")
| mvexpand ip
| dedup ip
| outputlookup <existing_lookup.csv>

and then fire above query in splunk using python script.

[vnravikumar]

Hi

Check this link

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Outputlookup

[agentsofshield]

Didn't help, can I get the specific example?

[vnravikumar]

Hi

Try with outputlookup command

ex:

|makeresults |eval id=3,name="test3" | outputlookup append=true samplelookup