Can I update KV-Store rows if the key is based on 2 fields?

[gwiner]

I would like to create a KV-Store that I can update, but the unique key for each row is the combination of 2 fields.
KV-store definition = _key, IncidentID, CompanyName, Priority, Impact, Status, IncidentTitle
with IncidentID+CompanyName being the business key for each row.

adding this
|outputlookup append=true key_field=IncidentID,CompanyName
to the end of my savedsearch is a major fail.

Is there a way to do this without performing an eval to concatenate the 2 fields into a single field to use as the key?

[masonmorales · Accepted solution]

The key is auto-generated by default, but you can override that behavior by specifying your own key. You have to perform an eval to concatenate the two fields together to make a single key. The key will not appear in an inputlookup of the KV store as long as you specify the key_field argument in your outputlookup.

| eval key=IncidentID.CompanyName 
| outputlookup append=true key_field=key

See also:
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/outputlookup