Is it possible to set the default value of a command's argument such as append=True for an outputlookup?

[Muryoutaisuu]

Hi

I'm amazed by Splunk's KV Store.
It's really easy to fill in data and to update rows. I usually use something like this:

| inputlookup coll_lookup | search "field1"="foo" | eval field1="bar" | outputlookup coll_lookup append=True

Without the append=True it would delete all other records and only save the updated values. I'm afraid users might forget that little parameter and then delete the whole data.

So my question is: Is there a way to change a prameter's default value of a command? Say set default value of append to True instead of False?

I'm aware I could do my search with subsearch or eval to have all data in table, as having all data won't delete any record. But I'm quite sure users won't think about that and erroneously delete the other records. Besides I'm curious too.

[musskopf]

You could use a Macro instead.

Just go to Settings -> Advanced Search and add a macro like that:

Name:
myMacro

Definition:
outputlookup coll_lookup append=True

After saved and configured the right permissions, just run you search:

| inputlookup coll_lookup | search "field1"="foo" | eval field1="bar" | `myMacro`

Yes, you need to use those *`** to call the macro
Also, I've tested using| outputlookup TestFile.csv append=True` and not a lookup definition, but should work in the same way.*

[Muryoutaisuu]

This actually sounds like a good idea. But still it is a workaround to the question of changing default values. Might do it like that if I don't get accurate answer to the question. Thank you.