topic Re: add/modify kvstore column in search head cluster environment in Deployment Architecture

add/modify kvstore column in search head cluster environment

karn — Wed, 25 Jun 2025 04:50:53 GMT

I have a question about modify kvstore configuration in search head cluster environment.

I have created kvstore with lookup editor app from a search head instance. Now, I would like to add a new column. So, I have to modify from collections.conf right?. However, the configuration is not on SHC but search head instances. What is the best way to add a new column of kvstore?

Thank you

Re: add/modify kvstore column in search head cluster environment

PaulPanther — Wed, 25 Jun 2025 08:20:49 GMT

Have you tried to use the API to add the field?

KV store endpoint descriptions - Splunk Documentation

Re: add/modify kvstore column in search head cluster environment

gcusello — Wed, 25 Jun 2025 08:26:51 GMT

Hi @karn ,

you could add a columns to a lookup using the Lookup Editor app, but remember to modify also the Lookup Definition.

With a csv lookup, you don't need to modify the Lookup Definition, but it's required for KV-Store lookups.

Ciao.

Giuseppe

Re: add/modify kvstore column in search head cluster environment

karn — Wed, 25 Jun 2025 09:13:12 GMT

I can't see editing menu on lookup editor app , please guide me.

Karn

Re: add/modify kvstore column in search head cluster environment

karn — Wed, 25 Jun 2025 10:15:36 GMT

it works.

curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/search/storage/collections/config/mykvstore -d "field.my_new_column=string"

Thanks