Splunk Dev

How to update KV store lookup periodically ,If user update csv file?

ajitshukla61116
Path Finder

Hello Splunkers,
Could you please help me design a solution for the below use case .

Usecase:I have one CSV file which contains Service center locations and has fields Name,Address,Status,Rating.
Now I want , if user updates any field in this file it should reflect in KV store lookup file .

What I tried:
I have created KV store lookup for KV store CRUD .In dashboard, I have created one form which contains all these input fields, where user can perform CRUD operations for KV store lookup file. Everything is working properly but I am not able to update the CSV file. Is there anyway to update CSV file also when we update KV store lookup?

Please help me to find the solution of this usecase.

Labels (1)
0 Karma

ursfischer
Engager

hi,

Did you find a solution? We also update some lookup files periodically almost the same way and the file itself  (/appl/splunk/etc/apps/APPNAME/lookups) will not update.

The KV store is up to date, but the file not... 

If i delete the file in the APP before the update, then the file is new created. Did you insert in your script that you delete the file in the folder bevor update or is there an other solution?

Greetings,

 

 

0 Karma

nickhills
Ultra Champion

Assuming both of these are lookup files, you can copy the entire contents of one to another with something as simple as:

|inputlookup csvLookupDefinition|outputlookup kvLookupDefinition

You could of course reverse the process (which i think is your last question) but you should be careful about about situations where there are deltas in both.

I'm not totally clear from your question if this is likely, but if so, you will want to expand the process to load both sets of data, perform any deduplication and establish which of the files contents takes precedence before writing your output.

If my comment helps, please give it a thumbs up!
0 Karma

ajitshukla61116
Path Finder

Thanks @nickhillscpl for your reply,Here CSV file is not a lookup file. The CSV file is stored at C:\Program Files\Splunk\etc\apps\myApp\bin and I want to know ,if I update this file(CSV) the same needs to be reflected in KV store lookup also or If I update KV store lookup the same thing also updated in CSV file.

0 Karma

nickhills
Ultra Champion

Must it be in that path?
If you moved the file to $SPLUNK_HOME/etc/apps/yourapp/lookups you could make it a lookup file and do as I mentioned above (both read & write to/from it)

If you have to leave it in another path, you could configure a file monitor on that path and index it.
That way changes to it would get ingested, and you could table the results and write it to the KV Store, but you would not be able to write changes back into it.

If my comment helps, please give it a thumbs up!
0 Karma

ajitshukla61116
Path Finder

Must it be in that path?
ans:Yes,I have a python file which also reading this CSV file. So its very difficult to me to change the location of CSV File.

Please check this link(https://www.hurricanelabs.com/splunk-tutorials/building-a-crud-dashboard-utilizing-a-kv-store-in-spl...) as a reference for KV store lookup CRUD oprations.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...