Splunk Search

How to update KV Store with consecutive values from a search?

Tomb
Engager

Hi, I'm trying to update a KV store so that the only entries in it will be for consecutive returns from a search.

 

For example, say the KV store has the existing fields:

Title Count
Daily Check 1 5
Daily Check 2 1
Daily Check 3 1

 

and the search returns:

Label
Daily Check 1
Daily Check 3
Daily Check 4

 

The new KV Store should look like:

Title Count
Daily Check 1 6
Daily Check 3 2
Daily Check 4 1

 

Thanks!

Labels (1)
0 Karma
1 Solution

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

View solution in original post

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

Tomb
Engager

Thank you, that's really useful and works great!

Just as a note though for anyone looking at this in future, I had to remove the 'isnotnull(in_KV)' as otherwise it only produced the results that were both in the search and KV store. As the count already gets updated and added together in the append stage, the in_KV store values can get removed (as they will have the in_search field if they need to stay in).  

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...