Knowledge Management

Can I update KV-Store rows if the key is based on 2 fields?

gwiner
New Member

I would like to create a KV-Store that I can update, but the unique key for each row is the combination of 2 fields.
KV-store definition = _key, IncidentID, CompanyName, Priority, Impact, Status, IncidentTitle
with IncidentID+CompanyName being the business key for each row.

adding this
|outputlookup append=true key_field=IncidentID,CompanyName
to the end of my savedsearch is a major fail.

Is there a way to do this without performing an eval to concatenate the 2 fields into a single field to use as the key?

0 Karma
1 Solution

masonmorales
Influencer

The key is auto-generated by default, but you can override that behavior by specifying your own key. You have to perform an eval to concatenate the two fields together to make a single key. The key will not appear in an inputlookup of the KV store as long as you specify the key_field argument in your outputlookup.

| eval key=IncidentID.CompanyName 
| outputlookup append=true key_field=key

See also:
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/outputlookup

View solution in original post

0 Karma

masonmorales
Influencer

The key is auto-generated by default, but you can override that behavior by specifying your own key. You have to perform an eval to concatenate the two fields together to make a single key. The key will not appear in an inputlookup of the KV store as long as you specify the key_field argument in your outputlookup.

| eval key=IncidentID.CompanyName 
| outputlookup append=true key_field=key

See also:
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/outputlookup

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...