topic Re: Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table? in Splunk Search

Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?

clyde772 — Tue, 14 Apr 2015 16:00:01 GMT

It seems using KV store from migrating from lookups seems to be very easy. Just outputlookup to a KV store stanza. But Is there an easy way to update a record, instead of just bulk reloading of a lookup table. For example, I would like to update a field for a record in KV store from the results from a Splunk search.

Re: Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?

dgladkikh_splun — Tue, 14 Apr 2015 18:48:52 GMT

Please take a look on http://dev.splunk.com/view/SP-CAAAEZH

By default, each KV Store record has a
unique key ID, which is stored in the
internal "_key" field. When you use
outputlookup to write to the KV Store,
a key ID is autogenerated if you don't
specify one explicitly. If you want to
modify a specific record, you need to
provide its key ID.

So to do what you want you need: a) know _key field b) use append=True c) have the whole record (not just one field), because outputlookup with append=true will replace existing document with specified _key.

Re: Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?

clyde772 — Fri, 17 Apr 2015 00:55:33 GMT

Thanks! dgladkikh_splunk!!

Re: Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?

TonyLeeVT — Wed, 04 May 2016 00:59:23 GMT

Would really appreciate an example one-liner. Thanks!

Re: Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?

sundareshr — Wed, 04 May 2016 01:20:03 GMT

Here's a good write up on kvstore

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH

Re: Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?

jagadeeshm — Mon, 22 Jan 2018 21:21:10 GMT

yeah, is there an example?