Splunk Search

How to update particular row of existing lookup csv ?

patra966
Path Finder

I have existing lookup csv. I want to update a row with new value.
ID Name Location
549 Test_1 Bangalore
549 Test_2 Delhi
729 Test_3 Mumbai
549 Test_4 Bangalore
729 Test_5 Bangalore

Test_4 will be replace with Test_8 and my lookup table will be look like as below

ID Name Location
549 Test_1 Bangalore
549 Test_2 Delhi
729 Test_3 Mumbai
549 Test_8 Bangalore
729 Test_5 Bangalore

How can I achieve it through search query.

Regards
Raja

Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The basic approach is to read in the CSV file, change what needs to be changed, and then re-write the file.

| inputlookup my.csv
| eval Name = if(Name=="Test_4", "Test_8", Name)
| outputlookup my.csv
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The basic approach is to read in the CSV file, change what needs to be changed, and then re-write the file.

| inputlookup my.csv
| eval Name = if(Name=="Test_4", "Test_8", Name)
| outputlookup my.csv
---
If this reply helps you, Karma would be appreciated.

patra966
Path Finder

Let consider another scenario.

If my Name column suppose to be "Test Name".

Case-1:

| inputlookup my.csv
| eval "Test Name" = if("Test Name"=="Test_4", "Test_8", "Test Name")
| outputlookup my.csv

For this I am getting like below:
ID Test Name Location
549 Test Name Bangalore
549 Test Name Delhi
729 Test Name Mumbai
549 Test Name Bangalore
729 Test Name Bangalore

Case- 2:

| inputlookup my.csv
| eval Test Name = if(Test Name=="Test_4", "Test_8", Test Name)
| outputlookup my.csv
Getting error for this.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...