Splunk Search

How to match event field to KV Store key

Path Finder

I have a kvstore collection with two columns: "_key", and "last_online". The idea is that a search to update the values, manually specifying the key, is scheduled and only needs to run with a time range as long as the schedule interval. In general this is so that other searches can access this information quickly via a lookup rather than running over an extended time range to find out when the device was last online.

I have the searches working properly but using a workaround that I'm trying to avoid. When I use the lookup, I'm unable to match an event field with the key field like so:

| makeresults count=1
| eval id = 1234
| lookup last_online_lookup _key as id OUTPUTNEW

One of the possible workarounds I've found is duplicating the key field in the collection so that it is accessible under another name. But the one I've opted for is changing the search to look like this:

| makeresults count=1
| eval id = 1234
| join type=left id [ | inputlookup last_online_lookup 
                      | eval id = _key ]

This achieves the desired result but I want to know if it's possible to match an event field to the internal _key field directly.

Any ideas?


0 Karma


You need to add _key to the field list on the fields section of your lookup transform definition.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...