Knowledge Management

How to append new row with few different values kv store?

sivaranjiniG
Path Finder

Here is my kv store lookup 

name rating comment experience  subject
A 3 good 4 math
B 4 very good 7 science

 

now i want to append new row like this with different rating

name rating comment experience  subject
A 3 good 4 math
B 4 very good 7 science
A 5 Excellent  4 math

 

i am trying to use 

 

 

| inputlookup table_a
      |search name="A" |eval rating=5 ,comment="Execellent" key=_key| outputlookup  append=true  key_field=key table_a

 

 

But this is not working..Please someone help me with this..

 

Thanks

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

In what way is it not working?

You are setting key_field to the key from the original record - which is what you would do if you are trying to update an existing row in the table, but you actually want to append a new row. Remove the key_field=key, but keep the append=true

 

0 Karma

sivaranjiniG
Path Finder

I tried it too.its not working

should i enable anything or add any property while creating lookup file

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you talking about lookup files or kv stores?

Can you describe what is not 'working' and give an example of what you see when you try the commands

 

0 Karma

sivaranjiniG
Path Finder

Its KV store..

when i try to add a row its updating the existing row

example, instead of this output i am getting

nameratingcommentexperience subject
A3good4math
B4very good7science
A5Excellent 4math

this,

nameratingcommentexperience subject
A5Excellent4math
B4very good7science

 

I tried these 2 solutions, I thought i dont have write access but i have i can update the  file but not able to add a new row

 

| inputlookup table_a
      |search name="A" |eval rating=5 ,comment="Execellent" key=_key| outputlookup  append=true  key_field=key table_a

-----------------------------

| inputlookup table_a
      |search name="A" |eval rating=5 ,comment="Execellent" | outputlookup  append=true table_a

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You are not doing what I suggested in my first response 

Remove the key_field=_key

You are explicitly telling it to update the SAME row in KV store

0 Karma

sivaranjiniG
Path Finder

Please read the my previous response fully...I have tried in both ways

Anyways thanks for your response. I found a solution 

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...