Hi,
I have created a KVstore
_key value should be avc_id field
In my case the key value is auto created, how to correct it?
hi @VijaySrrie,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values.
| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name
If this reply helps you, an upvote/like would be appreciated.
try
YOUR SEARCH
| eval key= avc_id
| outputlookup my_kvstore_name append=true key_field=key
This creates duplicate events with original and new _keys in the KVStore collection.
hi @VijaySrrie,
You can update the KVStore collection using outputlookup command with setting _key to the field avc_id values.
| inputlookup kvstore_lookup_name | eval _key=avc_id | outputlookup kvstore_lookup_name
If this reply helps you, an upvote/like would be appreciated.