Getting Data In

Record extract based on data value: KV Store/CSV

hemendralodhi
Contributor

Hello,

We have a requirement where we have one csv file which contains around 30K records of data and need to extract complete row based on data values passed as an API or search parameter. Each time there can be different data values passed.

What is the best and efficient way of achieving this. I was reading about KV store which might be able to give desired result.

Can I can use KV store or CSV lookup to test this? How this is achievable?

Thanks
Hemendra

0 Karma

alemarzu
Motivator

Hi there, try this.

your_search | outputcsv yourfilename.CSV

Get your file on $SPLUNK_HOME/var/run/splunk
Hope it helps.

0 Karma

hemendralodhi
Contributor

Hello,

Thanks for your response. I will check on this.

Another qq: Will search on KV Store/CSV store field data will output complete row?

Thanks
Hemendra

0 Karma

alemarzu
Motivator

Can tell if it works with the complete _raw data, but I believe its possible.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...