Splunk Search

How to update KV Store with consecutive values from a search?

Tomb
Engager

Hi, I'm trying to update a KV store so that the only entries in it will be for consecutive returns from a search.

 

For example, say the KV store has the existing fields:

Title Count
Daily Check 1 5
Daily Check 2 1
Daily Check 3 1

 

and the search returns:

Label
Daily Check 1
Daily Check 3
Daily Check 4

 

The new KV Store should look like:

Title Count
Daily Check 1 6
Daily Check 3 2
Daily Check 4 1

 

Thanks!

Labels (1)
0 Karma
1 Solution

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

View solution in original post

FelixLeh
Contributor

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count

| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

Tomb
Engager

Thank you, that's really useful and works great!

Just as a note though for anyone looking at this in future, I had to remove the 'isnotnull(in_KV)' as otherwise it only produced the results that were both in the search and KV store. As the count already gets updated and added together in the append stage, the in_KV store values can get removed (as they will have the in_search field if they need to stay in).  

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...