@sjodle, this can be done using batch_save endpoint http://docs.splunk.com/Documentation/Splunk/6.3.2/RESTREF/RESTkvstore#storage.2Fcollections.2Fdata.2F.7Bcollection.7D.2Fbatch_save You can find few examples on this page as well http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG As suggested by @Murali2888 - batch_save is very similar to SPL command outputlookup append=true , it inserts all new documents and replaces all documents which already exist in collection. ... View more

Ok, KVStore lookups available only starting from version 6.2 ... View more

Two options: a) you can use batch_save REST call http://docs.splunk.com/Documentation/Splunk/6.2.3/RESTREF/RESTkvstore#storage.2Fcollections.2Fdata.2F.7Bcollection.7D.2Fbatch_save It is limited by default to maximum of 1000 documents, so in your case it will take 3,000 calls. b) you can create a lookup for this collection, save your data into CSV file and migrate it from CSV into your kvstore collection by issuing a search like "| inputlookup myfile.csv | outputlookup mykvstorecollection_lookup" 2 & 3. That is not supported. Even if you will find out how to make 2 and 3 work - there are will be a huge chance that not everything will work as you expect or something can be broken with following updates. Please let us know if you have some other reasons (other than #1) why would you like to have #2 and #3. ... View more

If you want to take advantage of KVStore in Search Head Pooling environment you need a) Make all nodes of Search Head Pool to be visible to each other on the network. b) On each member of Search Head Pool specify the key you discovered (kvstore/replication_host) to the hostname, which can be used on other member to discover this member on network. c) Verify that kvstore/port is open and other member can get access to this port. d) Just start all members on by one. KVStore automatically will be configured with Cluster. e) You can use this REST endpoint to verify that KVStore is in Cluster now http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTintrospect#server.2Fintrospection.2Fkvstore.2Freplicasetstats or just query introspection index as it will be populated with introspection data including information from this url. Or use Distributed Management Console to check your configuration. ... View more

This is known issue in 6.2.2 http://docs.splunk.com/Documentation/Splunk/6.2.2/ReleaseNotes/Knownissues 2014-12-12 SPL-94017 mongod creates up to 65k files in /dev/shm/, using up to 500MB of space. Workaround is to "export MONGOC_DISABLE_SHM=1", or adding it to splunk-launch.conf. ... View more

Ok, I found the issue in tutorial, add return false; as the last statement of deleteRecord button handler, so it should be like $("#deleteRecord").click(function() { // Get the value of the key ID field var tokens = mvc.Components.getInstance("default"); var form_keyid = tokens.get("KeyID"); // Delete the record that corresponds to the key ID using // the del method to send a DELETE request // to the storage/collections/data/{collection}/ endpoint service.del("storage/collections/data/mycollection/" + encodeURIComponent(form_keyid)) .done(function() { // Run the search again to update the table search1.startSearch(); }); return false; }); This will prevent browser to submit the page (and do refresh of the page) which prevents current page to submit AJAX call before page reload. ... View more

Which version of splunk python sdk are you using? I used this script to verify python sdk using latest from https://github.com/splunk/splunk-sdk-python from splunklib.binding import httperror import splunklib.client as client import splunklib.results as results import json # admin user settings splunk_user = 'admin' splunk_pswd = 'changeme' splunk_host = 'localhost' splunk_port = 8089 splunk_app = 'search' splunk_owner = 'nobody' collections_conf_endpoint = 'storage/collections/config/' collections_data_endpoint = 'storage/collections/data/' collection_name = 'kvstore' admin_service = client.connect( host = splunk_host, port = splunk_port, username = splunk_user, password = splunk_pswd, app = splunk_app, owner = splunk_owner ) payload = { 'name': 'name', 'username': 'username', 'interval': 'interval' } payload = json.dumps(payload) # as an 'nobody' add data to the kv store (app 'search') request2 = admin_service.request( collections_data_endpoint + collection_name, method='post', headers=[('content-type', 'application/json')], body=payload, owner='nobody', app='search' ) print request2 it is working as expected $ python kvstore.py {'status': 201, 'headers': [('content-length', '35'), ('cache-control', 'no-store, no-cache, must-revalidate, max-age=0'), ('content-type', 'application/json; charset=UTF-8'), ('x-content-type-options', 'nosniff'), ('expires', 'Thu, 26 Oct 1978 00:00:00 GMT'), ('date', 'Tue, 24 Feb 2015 17:15:16 GMT'), ('server', 'Splunkd'), ('connection', 'Close'), ('vary', 'Authorization'), ('x-frame-options', 'SAMEORIGIN')], 'reason': 'Created', 'body': <splunklib.binding.ResponseReader object at 0x10abf2f50>} After that I verified that objects are exist (I run this script manually few times, so I have more than one object) $ curl -k -u admin:changeme https://outcoldx:8089/servicesNS/nobody/search/storage/collections/data/kvstore/ [ { "username" : "Username", "interval" : "Interval", "name" : "Name", "_user" : "nobody", "_key" : "54ecb0e22dbbb62b95054241" }, { "interval" : "Interval", "username" : "Username", "name" : "Name", "_user" : "nobody", "_key" : "54ecb1a42dbbb62b95054242" } ]% ... View more