https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463261#M6769 <P>We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store records need to be modified or deleted. We're thinking of adding a status field (Active, Inactive, Deleted) and always creating a new KV Store record when these things occur.</P> <P>Any examples around of doing something like this with a KV Store? Is there a way to allow users to modify a custom status field but not modify any other part of the record and not delete a record?</P> <P>Know of a better way to do this?</P> Fri, 18 Oct 2019 18:51:08 GMT driekhof 2019-10-18T18:51:08Z https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463261#M6769 <P>We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store records need to be modified or deleted. We're thinking of adding a status field (Active, Inactive, Deleted) and always creating a new KV Store record when these things occur.</P> <P>Any examples around of doing something like this with a KV Store? Is there a way to allow users to modify a custom status field but not modify any other part of the record and not delete a record?</P> <P>Know of a better way to do this?</P> Fri, 18 Oct 2019 18:51:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463261#M6769 driekhof 2019-10-18T18:51:08Z https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463262#M6770 <P>No there isn’t. Kvstore is a lookup table not a database. You can either read only or modify. </P> Fri, 18 Oct 2019 21:44:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463262#M6770 starcher 2019-10-18T21:44:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463263#M6771 <P>I think it actually is a DB under the covers (Mongo).</P> Mon, 21 Oct 2019 16:03:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463263#M6771 driekhof 2019-10-21T16:03:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463264#M6772 <P>Have you tried this: Use the REST API to manage KV Store collections and data:<BR /> <A href="https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/">https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/</A></P> Sun, 08 Dec 2019 04:04:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-audit-trail/m-p/463264#M6772 bthaker_splunk 2019-12-08T04:04:21Z