Splunk Search

Is it possible to set the default value of a command's argument such as append=True for an outputlookup?

Muryoutaisuu
Communicator

Hi

I'm amazed by Splunk's KV Store.
It's really easy to fill in data and to update rows. I usually use something like this:


| inputlookup coll_lookup | search "field1"="foo" | eval field1="bar" | outputlookup coll_lookup append=True

Without the append=True it would delete all other records and only save the updated values. I'm afraid users might forget that little parameter and then delete the whole data.

So my question is: Is there a way to change a prameter's default value of a command? Say set default value of append to True instead of False?

I'm aware I could do my search with subsearch or eval to have all data in table, as having all data won't delete any record. But I'm quite sure users won't think about that and erroneously delete the other records. Besides I'm curious too.

musskopf
Builder

You could use a Macro instead.

Just go to Settings -> Advanced Search and add a macro like that:

Name:
myMacro

Definition:
outputlookup coll_lookup append=True

After saved and configured the right permissions, just run you search:

| inputlookup coll_lookup | search "field1"="foo" | eval field1="bar" | `myMacro`

Yes, you need to use those *`** to call the macro
Also, I've tested using
| outputlookup TestFile.csv append=True` and not a lookup definition, but should work in the same way.*

Muryoutaisuu
Communicator

This actually sounds like a good idea. But still it is a workaround to the question of changing default values. Might do it like that if I don't get accurate answer to the question. Thank you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...