topic Re: How to add only specific fields to outputlookup? in Dashboards & Visualizations

How to add only specific fields to outputlookup?

pramit46 — Wed, 13 Jul 2016 10:33:36 GMT

I have three text input boxes in my dashboard. I want to add (/append) those values to a kvstore collection on clicking the submit button. I am trying to use outputlookup, but have not had any luck, yet.

Can somebody give me a clue? Please let me know if you need more information to understand the problem better.

Re: How to add only specific fields to outputlookup?

vr2312 — Wed, 13 Jul 2016 10:50:04 GMT

What is the outputlookup command string you are using ?

That would help us to proceed further.

Re: How to add only specific fields to outputlookup?

pramit46 — Wed, 13 Jul 2016 11:14:39 GMT

I tried:

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store

Re: How to add only specific fields to outputlookup?

pramit46 — Wed, 13 Jul 2016 12:33:46 GMT

I just want to add these fields into the KVStore collection. No index or sourcetype is involved here. Thus I thought, probably reading the kvstore first and then storing the values in it would work. But in vain.

Re: How to add only specific fields to outputlookup?

sundareshr — Wed, 13 Jul 2016 13:08:53 GMT

Have your tried append=t?

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=t

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup

Re: How to add only specific fields to outputlookup?

hardikJsheth — Wed, 13 Jul 2016 13:18:26 GMT

You need to open your lookup with append=True and then have eval statements.

For eg.

inputlookup append=T kv_store|eval id=$id$, oldval=$oldValue$, newval=$newValue$| table id, newval,oldval| outputlookup kv_store

Also if your input lookup is empty initially, you may need to add some search criteria so that you get a result before appending data to empty lookup

Re: How to add only specific fields to outputlookup?

vr2312 — Wed, 13 Jul 2016 13:37:05 GMT

Try using these :

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=TRUE

Re: How to add only specific fields to outputlookup?

pramit46 — Wed, 13 Jul 2016 20:38:58 GMT

I apologize for missing that part. I should have mentioned that later I tried that, too, but did not help much.

Re: How to add only specific fields to outputlookup?

pramit46 — Tue, 29 Sep 2020 10:12:27 GMT

Thanks a lot @hardikJsheth. I followed your cue and tried the following command. It worked.

Re: How to add only specific fields to outputlookup?

vr2312 — Thu, 14 Jul 2016 10:19:33 GMT

@pramit46 Did this work ?