All Apps and Add-ons

importing data to existing splunk kv store using lookup editor causing issues

sanjeev543
Communicator

I am trying to bulk edit the KV store lookup by exporting as CSV using lookup editor, once I make changes to the data fields (not modifying _key) and importing the same file using lookup editor causing data to be appended to the existing KV Store and it generating new _key values for the data.
Is there a way to restrict this behavior of lookup editor? @LukeMurphey

0 Karma
1 Solution

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

View solution in original post

0 Karma

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...