How to add new data in lookup from SPL query output ?

[zacksoft_wf]

My lookUp is a KV Store lookup.  It has three column  'is_active' , 'user', 'robot'.

I have a SPL query that gives me more information about the user. And I want to enrich the lookup with additional coulmns from that SPL output.

The SPL is , index=population sourcetype=bsassioan | table age, gender, email, user_name.

user_name in the same field as 'user' from the lookup.

I want to update my Kvstore lookup such as it should contain columns such as is_active, user, robot, age, gender, email  by matching the user_name with user field. 
 If the match is not found , let the field be empty and I don't want to override anything in the lookup, just addition of new columns and null/empty fileds (no overwrite) if user_name / user match is not found.

[isoutamo]

Hi

have you already read this https://hurricanelabs.com/splunk-tutorials/creating-and-cruding-a-kv-store-in-splunk-part-1/ ? If I recall right you could add new fields to current kvstore lookup as defined e.g. here https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/DefineaKVStorelookupinSplunkWeb and then update current rows by adding new values to those rows by specifying _key.

I suggest that you should test this first with some test kvstore lookup. And take first backup of that collection before you modify it.

r. Ismo

[zacksoft_wf]

Yes, I referred to that link.

I  wrote a spl , something like this.

| inputlookup myLookUp_Name  | rename lookUp_field as common_field | appendcol [ index = myIndex sourcetype=mySourcetype table SPL_field1, SPLfield2, SPL_field3]  
| table lookup_field1 lookup_field2 common_field SPL_field1 SPL_field2 SPL_field3 
| outputlookup myLookUp_Name append=t 

Above SPL generated the correct output that I would expect to see in the amended kvstore lookup, But after executing the query, although the message in the job inspector said that the collection is updated , but when I checked the look up | inputlookup myLookUp_Name  -- > It had no changes, new columns weren't added.

[isoutamo]

You must add first those new columns via settings or those other methods described on documents. After that you can add values by SPL query to those. In SPL it cannot create those fields, just add values to already existing fields.

r. Ismo