update KVStore Lookup with scheduled Alert

Path Finder

Hello Splunk Community,


I cannot figure out how to update a kvstore lookup table with a scheduled alert.

I want to append a search result every minute to an already exisitng kvstore lookup table. But when I specify said kvstore lookup table in the alert settings of splunk, it tells me that the file name of my kvstore lookup table has to end with .csv, which it doesn't. But I don't want it to because I am not using a static lookup table, I am using a kvstore lookup table.

Can I not use alerts with kvstore lookups?





Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...