添加链接
link管理
链接快照平台
  • 输入网页链接,自动生成快照
  • 标签化管理网页链接

Is there a Splunk query to add a new row or a new column to a lookup table?

I specifically ask for a query because I want my Python script to append rows automatically.

Thanks.

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>
| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

 [your search which produces results of 1 or more rows]
| inputlookup append=true mylookup.csv
|table field_id, field_a, field_b
|dedup field_id
|outputlookup mylookup.csv

Using this method you can add both rows and columns if needed by including them in the table command. This will load the 'old copy' of the file, and re-write the file with all the rows/columns present in the table.

Please try below query (In below query assume that I have single column in CSV with header IP).

<yourBaseSearch>
| eval ip="1.2.3.4"
| fields ip
| outputlookup append=t <existing_lookup.csv>
| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="1.2.3.4"]
| fields ip
| outputlookup <existing_lookup.csv>

EDIT: Updated query so only ip field will be added/updated in CSV lookup.

As you are using python so first create splunk query using python, if you want to add more results then you can do something like this while creating query.

Create variable called ip and with all values delimited with semicolon so something like this ip="3.4.5.6;10.10.0.1" and then use below splunk query

| inputlookup <existing_lookup.csv>
| append [ makeresults | eval ip="3.4.5.6;10.10.0.1" ]
| table ip
| eval ip=split(ip,";")
| mvexpand ip
| dedup ip
| outputlookup <existing_lookup.csv>

and then fire above query in splunk using python script.

Splunk, Splunk>, Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.