Getting Data In

How to update a kvstore field from a local CSV file?

edroche3rd
Explorer

Happy Sunday All!

I added a field to my KVSTORE, but want to be able to backfill that field with the appropriate data. I don't have access to the server to put input file on server then input. Is there a way to do it from a CSV from my desktop?

Thanks
Ed

0 Karma

n00badmin
Communicator

You could make an API call to manage the store..

http://dev.splunk.com/view/webframework-features/SP-CAAAEZG

or use | outputlookup my_kvstore

from search results (if ur data is avail there), where my_kvstore is the name of your store, to overwrite that kvstore entry...
be sure you look up the key first so you update/delete the right record!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...