I would like to create a KV-Store that I can update, but the unique key for each row is the combination of 2 fields.
KV-store definition = _key, IncidentID, CompanyName, Priority, Impact, Status, IncidentTitle
with IncidentID+CompanyName being the business key for each row.
adding this
|outputlookup append=true key_field=IncidentID,CompanyName
to the end of my savedsearch is a major fail.
Is there a way to do this without performing an eval to concatenate the 2 fields into a single field to use as the key?
The key is auto-generated by default, but you can override that behavior by specifying your own key. You have to perform an eval to concatenate the two fields together to make a single key. The key will not appear in an inputlookup of the KV store as long as you specify the key_field
argument in your outputlookup.
| eval key=IncidentID.CompanyName
| outputlookup append=true key_field=key
See also:
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/outputlookup
The key is auto-generated by default, but you can override that behavior by specifying your own key. You have to perform an eval to concatenate the two fields together to make a single key. The key will not appear in an inputlookup of the KV store as long as you specify the key_field
argument in your outputlookup.
| eval key=IncidentID.CompanyName
| outputlookup append=true key_field=key
See also:
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/outputlookup