Knowledge Management

kvstore

VijaySrrie
Builder

Hi,

I have created a KVstore

_key value should be avc_id field 

In my case the key value is auto created, how to correct it?

Labels (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @VijaySrrie,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values. 

| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@VijaySrrie 

try

 

 

YOUR SEARCH 
| eval key= avc_id
| outputlookup my_kvstore_name append=true key_field=key

 

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

This creates duplicate events with original and new _keys in the KVStore collection.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
I have updated answer.. My focus was just to point on use of key_field in outputlookup command 🙂
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @VijaySrrie,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values. 

| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name

 

If this reply helps you, an upvote/like would be appreciated.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...