I would like to create a KV-Store that I can update, but the unique key for each row is the combination of 2 fields.
KV-store definition = _key, IncidentID, CompanyName, Priority, Impact, Status, IncidentTitle
with IncidentID+CompanyName being the business key for each row.
|outputlookup append=true key_field=IncidentID,CompanyName
to the end of my savedsearch is a major fail.
Is there a way to do this without performing an eval to concatenate the 2 fields into a single field to use as the key?
... View more
When trying to execute a savedsearch from the CLI, I receive the following error in splunkd.log:
ERROR SearchOperator:savedsplunk - Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'SS_LIS18_Provisioning_Call_Coverage_Extract': Error while replacing variable name='carrierid'. Could not find variable in the argument map.
The truly puzzling thing about this is that the savedsearch executed quite nicely the previous day. The savedsearch executes from the search bar in the GUI when called by the |savedsearch command. Oh, and there is no variable named 'carrierid'. There is a 'CarrierID', and it's value is supplied, but no variable 'carrierid' in all lower case. And we all know that Splunk is definitely case-sensitive, right?
... View more