Splunk Search

How to match event field to KV Store key

packland
Path Finder

I have a kvstore collection with two columns: "_key", and "last_online". The idea is that a search to update the values, manually specifying the key, is scheduled and only needs to run with a time range as long as the schedule interval. In general this is so that other searches can access this information quickly via a lookup rather than running over an extended time range to find out when the device was last online.

I have the searches working properly but using a workaround that I'm trying to avoid. When I use the lookup, I'm unable to match an event field with the key field like so:

| makeresults count=1
| eval id = 1234
| lookup last_online_lookup _key as id OUTPUTNEW

One of the possible workarounds I've found is duplicating the key field in the collection so that it is accessible under another name. But the one I've opted for is changing the search to look like this:

| makeresults count=1
| eval id = 1234
| join type=left id [ | inputlookup last_online_lookup 
                      | eval id = _key ]

This achieves the desired result but I want to know if it's possible to match an event field to the internal _key field directly.

Any ideas?

Thanks.

0 Karma

starcher
SplunkTrust
SplunkTrust

You need to add _key to the field list on the fields section of your lookup transform definition.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...