Splunk outputlookup macro that ensure that only x% of a KV store are changed at once

macros.conf

[outputlookup_guard(2)]
args = name,allowed_changes
definition = eventstats count as new_count\
| eval old_count=[| inputlookup $name$ | stats count | return $count]\
| eval max_count=old_count*(1+$allowed_changes$), min_count=old_count/(1+$allowed_changes$)\
| where new_count>min_count and new_count<max_count\
| fields - new_count, old_count, min_count, max_count\
| outputlookup $name$ override_if_empty=false
iseval = 0
errormsg = 'name' must be a lookup and 'allowed_changes' must be a number between 0 and 1
validation = isstr($name$) and isnum($allowed_changes$)

Practical if override_if_empty=false is not enough 😄

Example usage: | outputlookup_guard(name=mylookup,allowed_changes=0.1) - this is like | outputlookup mylookup, it just ensures that those changes are only applied if the result set size does not differ more than 10%.