Is it possible to the output _key from a kvstore (i.e. with "lookup", not "inputlookup")?

[torleifg]

Is it possible to output the _key field from a kvstore when using lookup (not inputlookup)?

I.e. something like this:

... some search| lookup mykvstore some_field OUTPUT _key

(which does not seem to work)

I am aware of the need to rename _key to be able to display it when using inputlookup, but I need to use "lookup".

The use case is to keep track of how many times each row in the kvstore is looked up as part of a larger search.

[harsmarvania57 · Accepted solution]

Hi @torleifg,

Try below query

<yourSearch>| lookup mykvstore kvstore_field AS raw_data_field OUTPUT _key AS key

[torleifg]

Thanks, this worked perfectly, I was convinced I had already tried this, but somehow I must have missed it.