My lookUp is a KV Store lookup. It has three column 'is_active' , 'user', 'robot'. I have a SPL query that gives me more information about the user. And I want to enrich the lookup with addition...
See more...
My lookUp is a KV Store lookup. It has three column 'is_active' , 'user', 'robot'. I have a SPL query that gives me more information about the user. And I want to enrich the lookup with additional coulmns from that SPL output. The SPL is , index=population sourcetype=bsassioan | table age, gender, email, user_name. user_name in the same field as 'user' from the lookup. I want to update my Kvstore lookup such as it should contain columns such as is_active, user, robot, age, gender, email by matching the user_name with user field. If the match is not found , let the field be empty and I don't want to override anything in the lookup, just addition of new columns and null/empty fileds (no overwrite) if user_name / user match is not found.