https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430101#M122981 <P>Is it possible to output the _key field from a kvstore when using lookup (not inputlookup)?</P> <P>I.e. something like this:</P> <PRE><CODE>... some search| lookup mykvstore some_field OUTPUT _key </CODE></PRE> <P>(which does not seem to work)</P> <P>I am aware of the need to rename _key to be able to display it when using <CODE>inputlookup</CODE>, but I need to use "lookup".</P> <P>The use case is to keep track of how many times each row in the kvstore is looked up as part of a larger search.</P> Thu, 18 Oct 2018 23:10:50 GMT torleifg 2018-10-18T23:10:50Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430101#M122981 <P>Is it possible to output the _key field from a kvstore when using lookup (not inputlookup)?</P> <P>I.e. something like this:</P> <PRE><CODE>... some search| lookup mykvstore some_field OUTPUT _key </CODE></PRE> <P>(which does not seem to work)</P> <P>I am aware of the need to rename _key to be able to display it when using <CODE>inputlookup</CODE>, but I need to use "lookup".</P> <P>The use case is to keep track of how many times each row in the kvstore is looked up as part of a larger search.</P> Thu, 18 Oct 2018 23:10:50 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430101#M122981 torleifg 2018-10-18T23:10:50Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430102#M122982 <P>Hi @torleifg,</P> <P>Try below query</P> <PRE><CODE>&lt;yourSearch&gt;| lookup mykvstore kvstore_field AS raw_data_field OUTPUT _key AS key </CODE></PRE> Fri, 19 Oct 2018 08:27:18 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430102#M122982 harsmarvania57 2018-10-19T08:27:18Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430103#M122983 <P>Thanks, this worked perfectly, I was convinced I had already tried this, but somehow I must have missed it.</P> Fri, 19 Oct 2018 13:14:57 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-the-output-key-from-a-kvstore-i-e-with-quot/m-p/430103#M122983 torleifg 2018-10-19T13:14:57Z