I created a lookup as a CSV and want to view the contents of the CSV in Splunk. Is there an easy way to accomplish this? I can use the CSV but if I want to look at the contents of the CSV And If I want to edit the CSV I usually delete the CSV and add new. Is there a better way to update the CSV file?
| Inputlookup 123.csv --- for to look into the csv file
| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.
To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.
& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup
Thanks
| Inputlookup 123.csv --- for to look into the csv file
| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.
To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.
& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup
Thanks
Thanks for the additional details.
Hi - I am looking to download a inputlookup csv file but I am not able to do that. Is there a way to do that. Thanks.
To view the content of the csv please run
|inputlookup lookupname.csv in the search bar .
If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .
Thanks for getting back so quickly. This worked.