Knowledge Management

How do I bulk load a kvstore without having to have a curl command for each entry?

brent_weaver
Builder

I finally got my head wrapped around kvstore and how I can benefit from it. I have a bunch of data to load into a kvstore, how do I bulk load it without having to have a curl command for each entry?

0 Karma

woodcock
Esteemed Legend

There is an app to help you with this, Lookup File Editor App for Splunk Enterprise:

https://splunkbase.splunk.com/app/1724/

0 Karma

kmugglet
Communicator

Best idea would be to save your data as a CSV file.

Do an inputlookup for that file and an outputlookup to your kvstore.


| inputlookup data.csv
| outputlookup kvstore

That way you can do any extra ETL either in the CSV file, or between the inputlookup and outputlookup stages

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...