Hello Splunk Community,
I cannot figure out how to update a kvstore lookup table with a scheduled alert.
I want to append a search result every minute to an already exisitng kvstore lookup table. But when I specify said kvstore lookup table in the alert settings of splunk, it tells me that the file name of my kvstore lookup table has to end with .csv, which it doesn't. But I don't want it to because I am not using a static lookup table, I am using a kvstore lookup table.
Can I not use alerts with kvstore lookups?
Cheers
Fritz
