topic Re: append new row with few different values kv store in Knowledge Management

How to append new row with few different values kv store?

sivaranjiniG — Thu, 14 Sep 2023 17:12:15 GMT

Here is my kv store lookup

name	rating	comment	experience	subject
A	3	good	4	math
B	4	very good	7	science

now i want to append new row like this with different rating

name	rating	comment	experience	subject
A	3	good	4	math
B	4	very good	7	science
A	5	Excellent	4	math

i am trying to use

| inputlookup table_a |search name="A" |eval rating=5 ,comment="Execellent" key=_key| outputlookup append=true key_field=key table_a

But this is not working..Please someone help me with this..

Thanks

Re: append new row with few different values kv store

bowesmana — Wed, 13 Sep 2023 23:47:37 GMT

In what way is it not working?

You are setting key_field to the key from the original record - which is what you would do if you are trying to update an existing row in the table, but you actually want to append a new row. Remove the key_field=key, but keep the append=true

Re: append new row with few different values kv store

sivaranjiniG — Thu, 14 Sep 2023 02:20:28 GMT

I tried it too.its not working

should i enable anything or add any property while creating lookup file

Re: append new row with few different values kv store

bowesmana — Thu, 14 Sep 2023 03:24:56 GMT

Are you talking about lookup files or kv stores?

Can you describe what is not 'working' and give an example of what you see when you try the commands

Re: append new row with few different values kv store

sivaranjiniG — Thu, 14 Sep 2023 04:38:17 GMT

Its KV store..

when i try to add a row its updating the existing row

example, instead of this output i am getting

name	rating	comment	experience	subject
A	3	good	4	math
B	4	very good	7	science
A	5	Excellent	4	math

this,

name	rating	comment	experience	subject
A	5	Excellent	4	math
B	4	very good	7	science

I tried these 2 solutions, I thought i dont have write access but i have i can update the file but not able to add a new row

Re: append new row with few different values kv store

bowesmana — Thu, 14 Sep 2023 07:24:40 GMT

You are not doing what I suggested in my first response

Remove the key_field=_key

You are explicitly telling it to update the SAME row in KV store

Re: append new row with few different values kv store

sivaranjiniG — Thu, 14 Sep 2023 12:36:24 GMT

Please read the my previous response fully...I have tried in both ways

Anyways thanks for your response. I found a solution

Re: append new row with few different values kv store

cadrija — Thu, 24 Oct 2024 11:00:04 GMT

@sivaranjiniG Please let us know the solution as we are facing the same task.

Re: append new row with few different values kv store

DanielPi — Thu, 24 Oct 2024 14:09:47 GMT

Hi @cadrija,

I’m a Community Moderator in the Splunk Community.

This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!