Knowledge Management

kvstore

vijaysri
Contributor

Hi,

I have created a KVstore

_key value should be avc_id field 

In my case the key value is auto created, how to correct it?

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @vijaysri,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values. 

| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vijaysri 

try

 

 

YOUR SEARCH 
| eval key= avc_id
| outputlookup my_kvstore_name append=true key_field=key

 

0 Karma

manjunathmeti
Champion

This creates duplicate events with original and new _keys in the KVStore collection.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
I have updated answer.. My focus was just to point on use of key_field in outputlookup command 🙂
0 Karma

manjunathmeti
Champion

hi @vijaysri,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values. 

| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post