How to update a KV store field?

[guimilare]

Hello Splunkers.

I'm starting to work with KV store.
I used this exemple to practice: http://dev.splunk.com/view/SP-CAAAEZC

It's very interesting and is something I can use in my company with a little changes.
By the steps, we can ADD a row and DELETE a row.

How about updating a row?
I mean, I have the _key info, so I think that an update should be possible.
For example, a customer changed his address and I want to update his address field.

Can you guys help me?

Regards,
GMA

[aaraneta_splunk]

@guimilare - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[somesoni2 · Accepted solution]

See the information available here on how to update KV store data using lookup command. http://dev.splunk.com/view/SP-CAAAEZH#keyid

Look for 5th example under "Examples" section

| inputlookup csvcoll_lookup | search _key=544948df3ec32d7a4c1d9755 | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup csvcoll_lookup append=True

[JTS911]

Hi, 

Thanks