Splunk Add-on Builder ::=> API requested data to KV Stores

[kashz]

Using Add-on Builder:

Using Modular Input Python Code: I fetched the API data in JSON value, need to store in KV-Stores.

But the Add-on Builder Python Helper Functions (https://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/PythonHelperFunctions1) only specify write_to_index approach.
Is there an approach to store to KV-stores?

[lakshman239 · Accepted solution]

You can do something like the way demonstrated by @gstarcher

https://github.com/georgestarcher/TA-SyncKVStore/blob/master/bin/ta_synckvstore/modalert_synckvstore...

[chli_splunk]

You can use following functions to do this, although they are designed for checkpoint...

# save checkpoint
helper.save_check_point(key, state)
# delete checkpoint
helper.delete_check_point(key)
# get checkpoint
state = helper.get_check_point(key)

[kashz]

It will not work as my JSON returned from the API is not just a single {key: value} which checkpoint accepts.
I have multi-key-valued JSON with nested key-value pairs.

[chli_splunk]

Can you give a name of your JSON as a key? You can also check the source codes of helper function, or REST API to operate Splunk KVStore.