kvstore

[VijaySrrie]

Hi,

I have created a KVstore

_key value should be avc_id field 

In my case the key value is auto created, how to correct it?

[kamlesh_vaghela]

@VijaySrrie 

try

YOUR SEARCH 
| eval key= avc_id
| outputlookup my_kvstore_name append=true key_field=key

[manjunathmeti]

This creates duplicate events with original and new _keys in the KVStore collection.

[kamlesh_vaghela]

I have updated answer.. My focus was just to point on use of key_field in outputlookup command 🙂

[manjunathmeti · Accepted solution]

hi @VijaySrrie,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values. 

| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name

If this reply helps you, an upvote/like would be appreciated.