update KVStore Lookup with scheduled Alert

Path Finder

Hello Splunk Community,


I cannot figure out how to update a kvstore lookup table with a scheduled alert.

I want to append a search result every minute to an already exisitng kvstore lookup table. But when I specify said kvstore lookup table in the alert settings of splunk, it tells me that the file name of my kvstore lookup table has to end with .csv, which it doesn't. But I don't want it to because I am not using a static lookup table, I am using a kvstore lookup table.

Can I not use alerts with kvstore lookups?





Labels (2)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!