Splunk Dev

Is there a way to look at CSV files in the lookup ?

jhartm5
New Member

I created a lookup as a CSV and want to view the contents of the CSV in Splunk. Is there an easy way to accomplish this? I can use the CSV but if I want to look at the contents of the CSV And If I want to edit the CSV I usually delete the CSV and add new. Is there a better way to update the CSV file?

Tags (1)
0 Karma
1 Solution

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

View solution in original post

0 Karma

PowerPacked
Builder

| Inputlookup 123.csv --- for to look into the csv file

| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.

To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.

& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup

Thanks

0 Karma

jhartm5
New Member

Thanks for the additional details.

0 Karma

chasrini
New Member

Hi - I am looking to download a inputlookup csv file but I am not able to do that. Is there a way to do that. Thanks.

0 Karma

ssadanala1
Contributor

To view the content of the csv please run

|inputlookup lookupname.csv in the search bar .

If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .

https://splunkbase.splunk.com/app/1724/

jhartm5
New Member

Thanks for getting back so quickly. This worked.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...