Hello Splunkers.
I'm starting to work with KV store.
I used this exemple to practice: http://dev.splunk.com/view/SP-CAAAEZC
It's very interesting and is something I can use in my company with a little changes.
By the steps, we can ADD a row and DELETE a row.
How about updating a row?
I mean, I have the _key info, so I think that an update should be possible.
For example, a customer changed his address and I want to update his address field.
Can you guys help me?
Regards,
GMA
See the information available here on how to update KV store data using lookup command. http://dev.splunk.com/view/SP-CAAAEZH#keyid
Look for 5th example under "Examples" section
| inputlookup csvcoll_lookup | search _key=544948df3ec32d7a4c1d9755 | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup csvcoll_lookup append=True
@guimilare - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!
See the information available here on how to update KV store data using lookup command. http://dev.splunk.com/view/SP-CAAAEZH#keyid
Look for 5th example under "Examples" section
| inputlookup csvcoll_lookup | search _key=544948df3ec32d7a4c1d9755 | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup csvcoll_lookup append=True