All Apps and Add-ons

importing data to existing splunk kv store using lookup editor causing issues

sanjeev543
Communicator

I am trying to bulk edit the KV store lookup by exporting as CSV using lookup editor, once I make changes to the data fields (not modifying _key) and importing the same file using lookup editor causing data to be appended to the existing KV Store and it generating new _key values for the data.
Is there a way to restrict this behavior of lookup editor? @LukeMurphey

0 Karma
1 Solution

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

View solution in original post

0 Karma

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...