https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238912#M70989 <P>Maybe not an answer but thinking this through...<BR /> Each search generates artifacts in the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Dispatchdirectoryandsearchartifacts">dispatch directory</A>. As I understand it each search artifacts are a csv with the results of the search. Each pipe does 'something' to the csv file in a linear way. <BR /> Don't know if this is true but using that logic the csv file would need to be completed before it hit the outputlookp pipe.</P> Thu, 18 Aug 2016 13:34:28 GMT mtranchita 2016-08-18T13:34:28Z https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238911#M70988 <P>Hi,</P> <P>Do you know if "outputlookup" is an atomic operation (for both kvstores and csv files)?</P> <P>I have something like: | inputlookup xyz | (many commands) | outputlookup xyz<BR /> I need a guarantee that xyz lookup is either replaced with a new version or left untouched (in case of stopping search, system crash etc).</P> Wed, 17 Aug 2016 13:35:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238911#M70988 lukasz92 2016-08-17T13:35:49Z https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238912#M70989 <P>Maybe not an answer but thinking this through...<BR /> Each search generates artifacts in the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Dispatchdirectoryandsearchartifacts">dispatch directory</A>. As I understand it each search artifacts are a csv with the results of the search. Each pipe does 'something' to the csv file in a linear way. <BR /> Don't know if this is true but using that logic the csv file would need to be completed before it hit the outputlookp pipe.</P> Thu, 18 Aug 2016 13:34:28 GMT https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238912#M70989 mtranchita 2016-08-18T13:34:28Z https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238913#M70990 <P>Hello</P> <P>From this doc:</P> <PRE><CODE><A href="http://dev.splunk.com/view/SP-CAAAEY7" target="test_blank">http://dev.splunk.com/view/SP-CAAAEY7</A> </CODE></PRE> <P>Kv Store operations apply to individual records:</P> <PRE><CODE>Perform Create-Read-Update-Delete (CRUD) operations on individual records using the Splunk REST API and lookups using the Splunk search language. </CODE></PRE> <P>While the csv files are rewrited entirely:</P> <PRE><CODE>Requires a full rewrite of a file for edit operations. </CODE></PRE> <P>So, I would say that the csv files are rewrited completely or not touched, while updating a KV Store could be partial. That´s my understanding from that estatements</P> <P>Hope it helps</P> <P>Regards</P> Thu, 18 Aug 2016 14:16:55 GMT https://community.splunk.com/t5/Splunk-Search/Is-outputlookup-command-atomic/m-p/238913#M70990 gfuente 2016-08-18T14:16:55Z