Splunk Search

How to update KV Store with consecutive values from a search?

Tomb
Engager

Hi, I'm trying to update a KV store so that the only entries in it will be for consecutive returns from a search.

 

For example, say the KV store has the existing fields:

Title Count
Daily Check 1 5
Daily Check 2 1
Daily Check 3 1

 

and the search returns:

Label
Daily Check 1
Daily Check 3
Daily Check 4

 

The new KV Store should look like:

Title Count
Daily Check 1 6
Daily Check 3 2
Daily Check 4 1

 

Thanks!

Labels (1)
0 Karma
1 Solution

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

View solution in original post

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

Tomb
Engager

Thank you, that's really useful and works great!

Just as a note though for anyone looking at this in future, I had to remove the 'isnotnull(in_KV)' as otherwise it only produced the results that were both in the search and KV store. As the count already gets updated and added together in the append stage, the in_KV store values can get removed (as they will have the in_search field if they need to stay in).  

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...