Dashboards & Visualizations
Highlighted

How to add only specific fields to outputlookup?

Contributor

I have three text input boxes in my dashboard. I want to add (/append) those values to a kvstore collection on clicking the submit button. I am trying to use outputlookup, but have not had any luck, yet.

Can somebody give me a clue? Please let me know if you need more information to understand the problem better.

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

What is the outputlookup command string you are using ?

That would help us to proceed further.

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

I tried:

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store
0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

I just want to add these fields into the KVStore collection. No index or sourcetype is involved here. Thus I thought, probably reading the kvstore first and then storing the values in it would work. But in vain.

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

Try using these :

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=TRUE
0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

@pramit46 Did this work ?

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Legend

Have your tried append=t?

|inputlookup kv_store|eval id=$id$| eval oldval=$oldValue$| eval newval=$newValue$| table id, newval,oldval| outputlookup kv_store append=t

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

I apologize for missing that part. I should have mentioned that later I tried that, too, but did not help much.

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Motivator

You need to open your lookup with append=True and then have eval statements.

For eg.

inputlookup append=T kv_store|eval id=$id$, oldval=$oldValue$, newval=$newValue$| table id, newval,oldval| outputlookup kv_store

Also if your input lookup is empty initially, you may need to add some search criteria so that you get a result before appending data to empty lookup

View solution in original post

0 Karma
Highlighted

Re: How to add only specific fields to outputlookup?

Contributor

Thanks a lot @hardikJsheth. I followed your cue and tried the following command. It worked.

|inputlookup "KVStore" append=true
|eval id=$id$
| eval newval= "$newValue$"
| eval oldval="$oldValue$"
| dedup id
|table id, newval, oldval
| outputlookup "KV
Store" append=true

0 Karma