Splunk Search

Is outputlookup command atomic?

lukasz92
Communicator

Hi,

Do you know if "outputlookup" is an atomic operation (for both kvstores and csv files)?

I have something like: | inputlookup xyz | (many commands) | outputlookup xyz
I need a guarantee that xyz lookup is either replaced with a new version or left untouched (in case of stopping search, system crash etc).

0 Karma

gfuente
Motivator

Hello

From this doc:

http://dev.splunk.com/view/SP-CAAAEY7

Kv Store operations apply to individual records:

Perform Create-Read-Update-Delete (CRUD) operations on individual records using the Splunk REST API and lookups using the Splunk search language.

While the csv files are rewrited entirely:

Requires a full rewrite of a file for edit operations.

So, I would say that the csv files are rewrited completely or not touched, while updating a KV Store could be partial. That´s my understanding from that estatements

Hope it helps

Regards

0 Karma

mtranchita
Communicator

Maybe not an answer but thinking this through...
Each search generates artifacts in the dispatch directory. As I understand it each search artifacts are a csv with the results of the search. Each pipe does 'something' to the csv file in a linear way.
Don't know if this is true but using that logic the csv file would need to be completed before it hit the outputlookp pipe.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...