Hi, I am doing a POC to check if KV Store is a better option as compared to a traditional file lookup for my app. So I did the following things. Initialized KV Store through collection.conf removed all existing file-based lookups. changed searches in savedsearch.conf to populate KV Store instead of a traditional lookup. I am able to configure & use KV Store without any issue. But how I am getting a benefit here from using KV Store? Let's say one of my saved search is scheduled to execute at every hour and dump hundreds of result to lookup/KV Store. Now I know each time my search executes 90% of data is going to be the similar what I have dumped previously in my lookup/KV Store. In traditional lookup I don't have option to update my lookup with selective(modified) fields. I know KV Store is gives flexibility of updating only certain records stored in it. But is it possible to update only few records in KV Store using search query? Thanks, Pankaj ... View more

I am having two apps, Main app and Add-On app. Add-On app contains one data collector script which works as splunk data input script and feeds data to splunk. This data collector script is being executed at regular intervals and each time it gets sessionkey from splunk and uses it to fetch the encrypted credentials. I have also added Custom search command in main app, there is one wrapper script for custom search command in main app, which will collect command and options and pass it to the data collector script of Add-On app. But, whenever data collector script is being called by this wrapper, it is not able to get the sessionKey from splunk. Below are the contents of commands.conf for custom search command. [customCollect] filename = customCollect.py supports_getinfo=true generating=true supports_rawargs = true outputheader = true enableheader = true passauth = true streaming = false retainsevents = true changes_colorder = true overrides_timeorder = false In data collector script, I have tried below given two approaches to get sessionkey but none of them is working. 1) results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() sessionKey = settings.get("sessionKey", None) 2) sessionKey = sys.stdin.readline().strip() ... View more