Splunk Search

how to add a new column to existing inputlookup

james_n
Path Finder

Hi Experts,

Hi have existing inputlookup file like test.csv which contains 3 fields like host source sourcetype, i want to add extra one new filed called _time with these 3 fields. I have tried with basesearch | table host source soursetype _time|outputlookup test.csv append=true but new field is not appending

for example if I have this existing csv file contains 100 rows, then these 3 fileds along with new filed results shold be added from 101th row onwards in the csv. Plz help on this and thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need to re-write the entire CSV so the header has the new field name.

| inputlookup test.csv
| append [ basesearch ]
| dedup host source sourcetype
| table host source sourcetype _time
| outputlookup test.csv

The dedup command presumes you want unique tuples in your lookup file. If that's not the case, remove dedup.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...