https://community.splunk.com/t5/Splunk-Search/kvstore-with-custom-key-fields/m-p/432553#M123596 <P>You can set _key to whatever value you want. Such as the username value. Use eval _key=... before your outputlookup append=true</P> Fri, 15 Mar 2019 09:29:13 GMT starcher 2019-03-15T09:29:13Z https://community.splunk.com/t5/Splunk-Search/kvstore-with-custom-key-fields/m-p/432552#M123595 <P>Can I define a custom key field in a kvstore?</P> <P>I've created the kvstore with following configuration:<BR /> _key, targetUser, action, time<BR /> (the action will be add or remove)</P> <P>If the following entry exists: bob, add, 1552602818 <BR /> And I will add to kvstore the entry "bob, remove, 1552603818", action and time fields should be updated, rather than creating new entry<BR /> If targetUser is different (not existing in the kvstore) entry should be added.</P> <P>Is this possible? I will need to populate the kvstore as events arrive using a scheduled search.</P> <P>Thank you.</P> Thu, 14 Mar 2019 22:40:12 GMT https://community.splunk.com/t5/Splunk-Search/kvstore-with-custom-key-fields/m-p/432552#M123595 hoytn 2019-03-14T22:40:12Z https://community.splunk.com/t5/Splunk-Search/kvstore-with-custom-key-fields/m-p/432553#M123596 <P>You can set _key to whatever value you want. Such as the username value. Use eval _key=... before your outputlookup append=true</P> Fri, 15 Mar 2019 09:29:13 GMT https://community.splunk.com/t5/Splunk-Search/kvstore-with-custom-key-fields/m-p/432553#M123596 starcher 2019-03-15T09:29:13Z