Is it possible to output the _key field from a kvstore when using lookup (not inputlookup)?
I.e. something like this:
... some search| lookup mykvstore some_field OUTPUT _key
(which does not seem to work)
I am aware of the need to rename _key to be able to display it when using inputlookup
, but I need to use "lookup".
The use case is to keep track of how many times each row in the kvstore is looked up as part of a larger search.
Hi @torleifg,
Try below query
<yourSearch>| lookup mykvstore kvstore_field AS raw_data_field OUTPUT _key AS key
Hi @torleifg,
Try below query
<yourSearch>| lookup mykvstore kvstore_field AS raw_data_field OUTPUT _key AS key
Thanks, this worked perfectly, I was convinced I had already tried this, but somehow I must have missed it.