I have a CSV lookup present with 1000 rows as per the below query.
sourcetype="snow:cmdb_ci_service" | stats latest(*) as * by dv_name
If any field needs to be modified based on dv_name row, is it possible to do the changes ?
If yes, how to modify the data using the query?
Hi
Check the solution by @richgalloway
https://answers.splunk.com/answers/755079/how-do-i-update-a-lookup-file-with-updated-informa.html