Today we will see how to add new fields in existing lookup file. There are occasions where we have a lookup file with some values and with time we need some addition of rows.
Old Lookup –
Query: |inputlookup Acc_no
In the above lookup we can see two fields Acc_no and Name with 4 values each. We will target to add one more values each to these existing 4 rows. So finally we will have a total of 5 rows.
Now we need to modify the query for adding new values in lookup file.
Old lookup with new field-values
| inputlookup Acc_no append=true | append [ | stats count | eval ACC_NO=”123456789100″ , Name=”abc” | table ACC_NO Name]
If we want to add that in lookup file we just need to add outputlookup and it will update old lookup file with new values.
Updated Lookup –
| inputlookup Acc_no append=true | append [ | stats count | eval ACC_NO="123456789100" , Name="bcd" | table ACC_NO Name]|outputlookup Acc_no.csv
To check whether your lookup is updated or not, one can simply run,
| inputlookup Acc_no.csvIf you are still facing issue regarding this how to add new fields in existing lookup file Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on 👍 Social Networks, happy Splunking >😉
