Hello everyone!
I have a static lookup which has two fields/columns State and tag. Default value of State is "Enabled" for all the tags as mentioned below.
tag State
platformA Enabled
platformB Enabled
platformC Enabled
platformD Enabled
I want to give the capability to user to alter the State of tag to "Disabled" as and when required.
So basically they would be altering this static lookup and dump the modified result to the same lookup as mentioned below.
tag State
platformA Disabled
platformB Enabled
platformC Enabled
platformD Enabled
I am able to replace the State in my search but if I do append after outputlookup then it appends a new record and if I don't do append then it deletes all other existing records and keep only the newly replaced record.
I have tried with below two queries:
Query 1-
| inputlookup tags.csv where tag=platformA | replace "Disabled" with "Enabled" in State | outputlookup append=t tags.csv
Query 2-
| inputlookup tags.csv where tag=platformA | replace "Disabled" with "Enabled" in State | outputlookup tags.csv
Am I missing anything? Or is there a better approach to this?
Thanks in advance.
Hi @MousumiChowdhury,
in situations like the one you described, I usually prefer to use the Lookup File Editor app tha you can find at https://splunkbase.splunk.com/app/1724/ .
Ciao.
Giuseppe