topic Re: How to append key/value pairs to a kvstore lookup? in Knowledge Management

How to append key/value pairs to a kvstore lookup?

jwalzerpitt — Fri, 07 Oct 2022 14:28:02 GMT

I have a search that leverages a kvstore lookup that takes the src IP and then checks the lookup to see what core, content, and zone the IP is associated with:

Unfortunately, we do not have a ROA for this info so we have populated the kvstore lookup from various sources as best we can, but sometimes we'll see src IPs with no zone listed. I do have a table I keep that allows me to fill in those blanks and it's a simple table as follows:

cidr_range zone x.x.x.x/16 zone1 y.y.y.y/24 zone2 z.z.z.z/24 zone3

I'd like to create a search that appends my lookup with this data - how would I write that search?

Thx

Re: How to append key/value pairs to a kvstore lookup?

johnhuang — Fri, 07 Oct 2022 14:38:03 GMT

Few questions:

I do have a table I keep that allows me to fill.....

By table do you mean index or lookup?

I'd like to create a search that appends my lookup with this data

By append, did you mean 1. you want this data to enrich the current search, or 2. you want to append to the kvstore lookup as new rows, or 3. you want to update the existing kvstore null records?

Re: How to append key/value pairs to a kvstore lookup?

jwalzerpitt — Fri, 07 Oct 2022 14:46:57 GMT

Great questions and allow me to clarify:

I have this data in a spreadsheet that I simply refer back to
I want to append to the kvstore lookup as new rows as the data I have in my spreadsheet doesn't exist in the kvstore

For example, I see src IPs that have no zone associated with them because that data is not in the kvstore, but in my spreadsheet so I'd like to append that data so it's in the kvstore/lookup

Hope this helps

Thx

Re: How to append key/value pairs to a kvstore lookup?

johnhuang — Fri, 07 Oct 2022 15:23:35 GMT

Once you upload your spreadsheet as a lookup csv, you can access it in a search. Here's how you can write the search to update the kvstore.

Assuming that the fieldnames are cidr_range and zone:

| inputlookup spreadsheet_data.csv | lookup zone_lookup cidr_range OUTPUT zone AS zone2 | search NOT zone2=* | table cidr_range zone

Once you've validated the results, you can update the kvstore by adding the following line to the end of the search.

| outputlookup zone_lookup append=true

Re: How to append key/value pairs to a kvstore lookup?

jwalzerpitt — Tue, 11 Oct 2022 10:51:40 GMT

Thx for the solution!