Splunk Search

How to save search results to KV store?

New Member

I have a simple search:

index =abc OR index =xxx |transaction DIGEST | eval match_count=mvcount(sourcetype) | eval Digest_MATCH=if(match_count==2,"MATCH","MISSING") | table _time, DIGEST, Digest_MATCH, sourcetype

I want store all rows where digest_match = missing into KV store and lookup values to see if there any matches for missing values in future searches.

0 Karma


Here is a great posting on this subject


Splunk Employee
Splunk Employee

Hi Pragadeesh,

You'll need to use the outputlookup command to push those results into a lookup. From there, you can convert your lookup table to a KV Store.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...