Splunk Enterprise Security

KV Store - audit trail?

driekhof
Path Finder

We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store records need to be modified or deleted. We're thinking of adding a status field (Active, Inactive, Deleted) and always creating a new KV Store record when these things occur.

Any examples around of doing something like this with a KV Store? Is there a way to allow users to modify a custom status field but not modify any other part of the record and not delete a record?

Know of a better way to do this?

0 Karma

bthaker_splunk
Splunk Employee
Splunk Employee

Have you tried this: Use the REST API to manage KV Store collections and data:
https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/

0 Karma

starcher
Influencer

No there isn’t. Kvstore is a lookup table not a database. You can either read only or modify.

0 Karma

driekhof
Path Finder

I think it actually is a DB under the covers (Mongo).

Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...