Knowledge Management

KV Store Update Multiple Records

kdroddy
Explorer

Quick question about KV store - wondering what the best way to update multiple records at once via search may be?

Example - let's say I have the most recent logon for users for the past week:

user1 - last_logon_time
user2 - last_logon_time
etc....

I would like to query last_logon_time for all users for the past day, then update the KV store with the most recent info. The goal would be to set this up as a schedule search running daily to keep the KV store updated.

Any thoughts?

Labels (1)
0 Karma

sciencenfaith
Engager

If I understood the question correctly, it seems very similar to updating a KV Store as described in https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/, but with multiple entries at once. So, instead of: 

 

| inputlookup csvcoll_lookup | search _key=544948df3ec32d7a4c1d9755 | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup csvcoll_lookup append=True

 

try something like: 

 

| inputlookup csvcoll_lookup | where _key IN("544948df3ec32d7a4c1d9755","544948df3ec32d7a4c1d9756","544948df3ec32d7a4c1d9757") | eval CustName="Marge Simpson" | eval CustCity="Springfield" | outputlookup csvcoll_lookup append=True

 

 

The critical difference is "| where _key IN" to list the keys you want to manipulate instead of searching for a single one.  

 

 

EDIT: sorry, I replied to the reply instead of the OP. Removed original and posted correctly.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kdroddy

Can you please share your existing sample search/ code for updating KVStore and the sample KVstore fields?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...