topic KV Store Update Multiple Records in Knowledge Management

KV Store Update Multiple Records

kdroddy — Wed, 30 Sep 2020 05:15:39 GMT

Quick question about KV store - wondering what the best way to update multiple records at once via search may be?

Example - let's say I have the most recent logon for users for the past week:

user1 - last_logon_time
user2 - last_logon_time
etc....

I would like to query last_logon_time for all users for the past day, then update the KV store with the most recent info. The goal would be to set this up as a schedule search running daily to keep the KV store updated.

Any thoughts?

Re: KV Store Update Multiple Records

kamlesh_vaghela — Thu, 30 Apr 2020 05:18:24 GMT

@kdroddy

Can you please share your existing sample search/ code for updating KVStore and the sample KVstore fields?

Re: KV Store Update Multiple Records

sciencenfaith — Thu, 03 Sep 2020 21:26:16 GMT

If I understood the question correctly, it seems very similar to updating a KV Store as described in https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/, but with multiple entries at once. So, instead of:

try something like:

| inputlookup csvcoll_lookup | where _key IN("544948df3ec32d7a4c1d9755","544948df3ec32d7a4c1d9756","544948df3ec32d7a4c1d9757") | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup csvcoll_lookup append=True

The critical difference is "| where _key IN" to list the keys you want to manipulate instead of searching for a single one.

EDIT: sorry, I replied to the reply instead of the OP. Removed original and posted correctly.