Hi
I'm amazed by Splunk's KV Store.
It's really easy to fill in data and to update rows. I usually use something like this:
| inputlookup coll_lookup | search "field1"="foo" | eval field1="bar" | outputlookup coll_lookup append=True
So my question is: Is there a way to change a prameter's default value of a command? Say set default value of append to True instead of False?
I'm aware I could do my search with subsearch or eval to have all data in table, as having all data won't delete any record. But I'm quite sure users won't think about that and erroneously delete the other records. Besides I'm curious too.
You could use a Macro instead.
Just go to Settings -> Advanced Search and add a macro like that:
Name:
myMacro
Definition:
outputlookup coll_lookup append=True
After saved and configured the right permissions, just run you search:
| inputlookup coll_lookup | search "field1"="foo" | eval field1="bar" | `myMacro`
Yes, you need to use those *`** to call the macro
| outputlookup TestFile.csv append=True` and not a lookup definition, but should work in the same way.*
Also, I've tested using
This actually sounds like a good idea. But still it is a workaround to the question of changing default values. Might do it like that if I don't get accurate answer to the question. Thank you.