Dashboards & Visualizations

How to add only specific fields to outputlookup?

pramit46
Contributor

I have three text input boxes in my dashboard. I want to add (/append) those values to a kvstore collection on clicking the submit button. I am trying to use outputlookup, but have not had any luck, yet.

Can somebody give me a clue? Please let me know if you need more information to understand the problem better.

0 Karma
1 Solution

hardikJsheth
Motivator

You need to open your lookup with append=True and then have eval statements.

For eg.

inputlookup append=T kv_store|eval id=$id$, oldval=$oldValue$, newval=$newValue$| table id, newval,oldval| outputlookup kv_store

Also if your input lookup is empty initially, you may need to add some search criteria so that you get a result before appending data to empty lookup

View solution in original post

0 Karma

hardikJsheth
Motivator

You need to open your lookup with append=True and then have eval statements.

For eg.

inputlookup append=T kv_store|eval id=$id$, oldval=$oldValue$, newval=$newValue$| table id, newval,oldval| outputlookup kv_store

Also if your input lookup is empty initially, you may need to add some search criteria so that you get a result before appending data to empty lookup

0 Karma

pramit46
Contributor

Thanks a lot @hardikJsheth. I followed your cue and tried the following command. It worked.

|inputlookup "KV_Store" append=true
|eval id=$id$
| eval newval= "$newValue$"
| eval oldval="$oldValue$"
| dedup id
|table id, newval, oldval
| outputlookup "KV_Store" append=true

0 Karma

sundareshr
Legend

Have your tried append=t?

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=t

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup

0 Karma

pramit46
Contributor

I apologize for missing that part. I should have mentioned that later I tried that, too, but did not help much.

0 Karma

vr2312
Contributor

What is the outputlookup command string you are using ?

That would help us to proceed further.

0 Karma

pramit46
Contributor

I tried:

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store
0 Karma

pramit46
Contributor

I just want to add these fields into the KVStore collection. No index or sourcetype is involved here. Thus I thought, probably reading the kvstore first and then storing the values in it would work. But in vain.

0 Karma

vr2312
Contributor

Try using these :

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=TRUE
0 Karma

vr2312
Contributor

@pramit46 Did this work ?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...