https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272588#M52356 <P>Yes, that is correct.</P> Fri, 03 Mar 2017 02:57:19 GMT woodcock 2017-03-03T02:57:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272585#M52353 <P>Hello all! I am struggling to fully understand kvstore and how to get at the data. I am not having any issues populating kvstore via curl ( <A href="http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG">http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG</A> ). The question I have is how to I get to that data? I cannot seem to put it together. </P> <P>My ultimate goal is to build automatic lookups of our CloudFoundry config files to be able to correlate the ephemeral hosts in CF. Since it is such a dynamic environment I thought that I would read the config file and via a script (in really any language) write to kvstore in Splunk where it can be correlated.</P> <P>Any help is MUCH appreciated!</P> Wed, 01 Feb 2017 14:08:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272585#M52353 brent_weaver 2017-02-01T14:08:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272586#M52354 <P>There is an app to help you with this, <CODE>Lookup File Editor App for Splunk Enterprise</CODE>:</P> <P><A href="https://splunkbase.splunk.com/app/1724/">https://splunkbase.splunk.com/app/1724/</A></P> <P>Anyway, the easiest way to get to the lookup data is to use a search like this:</P> <PRE><CODE>|inputlookup YourLookupNameHere </CODE></PRE> Thu, 02 Mar 2017 19:04:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272586#M52354 woodcock 2017-03-02T19:04:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272587#M52355 <P>Whether it's a kvstore or a lookup the syntax remains the same to get the lookup working!</P> Fri, 03 Mar 2017 02:34:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272587#M52355 gjanders 2017-03-03T02:34:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272588#M52356 <P>Yes, that is correct.</P> Fri, 03 Mar 2017 02:57:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-kvstore-to-store-configurations-for-correlation/m-p/272588#M52356 woodcock 2017-03-03T02:57:19Z