Is outputlookup command atomic?

[lukasz92]

Hi,

Do you know if "outputlookup" is an atomic operation (for both kvstores and csv files)?

I have something like: | inputlookup xyz | (many commands) | outputlookup xyz
I need a guarantee that xyz lookup is either replaced with a new version or left untouched (in case of stopping search, system crash etc).

[gfuente]

Hello

From this doc:

http://dev.splunk.com/view/SP-CAAAEY7

Kv Store operations apply to individual records:

Perform Create-Read-Update-Delete (CRUD) operations on individual records using the Splunk REST API and lookups using the Splunk search language.

While the csv files are rewrited entirely:

Requires a full rewrite of a file for edit operations.

So, I would say that the csv files are rewrited completely or not touched, while updating a KV Store could be partial. That´s my understanding from that estatements

Hope it helps

Regards

[mtranchita]

Maybe not an answer but thinking this through...
Each search generates artifacts in the dispatch directory. As I understand it each search artifacts are a csv with the results of the search. Each pipe does 'something' to the csv file in a linear way.
Don't know if this is true but using that logic the csv file would need to be completed before it hit the outputlookp pipe.