Splunk Search

Is there an easy way to update a record in KV Store from the results of a Splunk search instead of bulk reloading a lookup table?


It seems using KV store from migrating from lookups seems to be very easy. Just outputlookup to a KV store stanza. But Is there an easy way to update a record, instead of just bulk reloading of a lookup table. For example, I would like to update a field for a record in KV store from the results from a Splunk search.


Splunk Employee
Splunk Employee

Please take a look on http://dev.splunk.com/view/SP-CAAAEZH

By default, each KV Store record has a
unique key ID, which is stored in the
internal "_key" field. When you use
outputlookup to write to the KV Store,
a key ID is autogenerated if you don't
specify one explicitly. If you want to
modify a specific record, you need to
provide its key ID.

So to do what you want you need: a) know _key field b) use append=True c) have the whole record (not just one field), because outputlookup with append=true will replace existing document with specified _key.


Would really appreciate an example one-liner. Thanks!


yeah, is there an example?


Thanks! dgladkikh_splunk!!

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!