topic Re: Python SDK and KVStore in Splunk Dev

How to create a KVStore using Python SDK w/ SPL commands?

yurippe — Wed, 17 Jun 2020 20:52:17 GMT

Hello,
I am trying to create a kvstore that I can use in a | inputlookup and / or | lookup SPL command. I can create a KVStore using the python SDK, but it can not be used with the above commands.
(I have tried many things and variations in the create command, but this is what I assume to be the most correct:)

>>> splunk.kvstore.create(name="testkvstore", **{"sharing": "global"})
{'status': 201, ...}
>>> splunk.kvstore["testkvstore"].data.app
'system'
>>> splunk.kvstore["testkvstore"].data.sharing
'system'
>>> splunk.kvstore["testkvstore"].data.owner
'nobody'

>>> splunk.kvstore["testkvstore"].data.insert(json.dumps({"_key": "test", "value": "result"}))
{'_key': 'test'}

Yet I cannot find it with inputlookup nor lookup. This does not work in splunk cloud nor local instance

Re: Python SDK and KVStore

starcher — Mon, 26 Aug 2019 18:26:18 GMT

Did you create a transforms stanza to reference the kvstore collection?

Re: Python SDK and KVStore

yurippe — Mon, 26 Aug 2019 18:56:55 GMT

No, any tips on how I would do this via the RESP API ?

Re: Python SDK and KVStore

yurippe — Mon, 26 Aug 2019 19:46:37 GMT

I figured it out, thank you very much
Here is enough code to be able to figure it out for anyone else who might stumble upon this:

kv = splunk.kvstore
kv.create(name="kvtestcollection", fields={"_key": "string", "name": "string"}, owner="nobody", sharing="system")
kv["kvtestcollection"].data.insert(json.dumps({"_key": "hello", "name": "world"}))
#kv["kvtestcollection"].delete()
transforms = splunk.confs["transforms"]
transforms.create(name="kvtestcollection_lookup", **{"external_type": "kvstore", "collection": "kvtestcollection", "fields_list": "_key, name", "owner": "nobody"})
#transforms["kvtestcollection_lookup"].delete()