Hi Experts,
Hi have existing inputlookup file like test.csv which contains 3 fields like host source sourcetype, i want to add extra one new filed called _time with these 3 fields. I have tried with basesearch | table host source soursetype _time|outputlookup test.csv append=true
but new field is not appending
for example if I have this existing csv file contains 100 rows, then these 3 fileds along with new filed results shold be added from 101th row onwards in the csv. Plz help on this and thanks in advance.
I think you need to re-write the entire CSV so the header has the new field name.
| inputlookup test.csv
| append [ basesearch ]
| dedup host source sourcetype
| table host source sourcetype _time
| outputlookup test.csv
The dedup
command presumes you want unique tuples in your lookup file. If that's not the case, remove dedup
.