How to add only specific fields to outputlookup?

[pramit46]

I have three text input boxes in my dashboard. I want to add (/append) those values to a kvstore collection on clicking the submit button. I am trying to use outputlookup, but have not had any luck, yet.

Can somebody give me a clue? Please let me know if you need more information to understand the problem better.

[hardikJsheth · Accepted solution]

You need to open your lookup with append=True and then have eval statements.

For eg.

inputlookup append=T kv_store|eval id=$id$, oldval=$oldValue$, newval=$newValue$| table id, newval,oldval| outputlookup kv_store

Also if your input lookup is empty initially, you may need to add some search criteria so that you get a result before appending data to empty lookup

[pramit46]

Thanks a lot @hardikJsheth. I followed your cue and tried the following command. It worked.

|inputlookup "KV_Store" append=true
|eval id=$id$
| eval newval= "$newValue$"
| eval oldval="$oldValue$"
| dedup id
|table id, newval, oldval
| outputlookup "KV_Store" append=true

[sundareshr]

Have your tried append=t?

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=t

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup

[pramit46]

I apologize for missing that part. I should have mentioned that later I tried that, too, but did not help much.

[vr2312]

What is the outputlookup command string you are using ?

That would help us to proceed further.

[pramit46]

I tried:

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store

[pramit46]

I just want to add these fields into the KVStore collection. No index or sourcetype is involved here. Thus I thought, probably reading the kvstore first and then storing the values in it would work. But in vain.

[vr2312]

Try using these :

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=TRUE

[vr2312]

@pramit46 Did this work ?