Getting Data In

Append and Update the CSV from a search output

gozdeyildiz
New Member

Hello,

I have a search which gives the output of the fields a and b. I am saving those outputs to a csv lets say output.csv. I would like to update with the latest value of the value a and b which means I do not want old/duplicate values for a and b and append non-existing values to the CSV file . I tried to do it with the left join but I was not successful.

Example: from the search fields below output is populated and writen to the csv.

name - age

bob 23
joey 33

and from another search fields below output is populated

name - age

joey 43

So I want my output.csv files to become below format.

name - age

bob 23
joey 43

Any help?

Bests!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

CSV files must be updated in their entirety. The usual method is to read in the CSV, append the results of a search, deduplicate the results, and write them to the CSV.

| inputlookup output.csv
| append [ <your search> ]
| dedup name
| outputlookup outputs.csv
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

CSV files must be updated in their entirety. The usual method is to read in the CSV, append the results of a search, deduplicate the results, and write them to the CSV.

| inputlookup output.csv
| append [ <your search> ]
| dedup name
| outputlookup outputs.csv
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...