Splunk Search

How to update KV Store with consecutive values from a search?

Tomb
Engager

Hi, I'm trying to update a KV store so that the only entries in it will be for consecutive returns from a search.

 

For example, say the KV store has the existing fields:

Title Count
Daily Check 1 5
Daily Check 2 1
Daily Check 3 1

 

and the search returns:

Label
Daily Check 1
Daily Check 3
Daily Check 4

 

The new KV Store should look like:

Title Count
Daily Check 1 6
Daily Check 3 2
Daily Check 4 1

 

Thanks!

Labels (1)
0 Karma
1 Solution

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

View solution in original post

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

Tomb
Engager

Thank you, that's really useful and works great!

Just as a note though for anyone looking at this in future, I had to remove the 'isnotnull(in_KV)' as otherwise it only produced the results that were both in the search and KV store. As the count already gets updated and added together in the append stage, the in_KV store values can get removed (as they will have the in_search field if they need to stay in).  

0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...