How to update KV Store with consecutive values from a search?

[Tomb]

Hi, I'm trying to update a KV store so that the only entries in it will be for consecutive returns from a search.

For example, say the KV store has the existing fields:

Title	Count
Daily Check 1	5
Daily Check 2	1
Daily Check 3	1

and the search returns:

Label

Daily Check 1

Daily Check 3

Daily Check 4

The new KV Store should look like:

Title	Count
Daily Check 1	6
Daily Check 3	2
Daily Check 4	1

Thanks!

[FelixLeh · Accepted solution]

yourSearch 
| eval in_search="true"
| table Title in _search
| append [ | inputlookup KVStore | eval in_KV = "true"]
| stats values(in_KV) as in_KV values(in_search) as in_search sum(Count) as Count by Title
| where isnotnull(in_search) AND isnotnull(in_KV)
| fields Title Count
| outputlookup KVStore

This replaces the entire KVStore with only the Events that are both in the search and the KVStore and Updates the count field. Also test the query without the outputlookup command first to see if it works.

I hope this helps!

_______________________________________

If this was helpful please consider awarding Karma. Thx!

[Tomb]

Thank you, that's really useful and works great!

Just as a note though for anyone looking at this in future, I had to remove the 'isnotnull(in_KV)' as otherwise it only produced the results that were both in the search and KV store. As the count already gets updated and added together in the append stage, the in_KV store values can get removed (as they will have the in_search field if they need to stay in).