add/modify kvstore column in search head cluster environment

[karn]

I have a question about modify kvstore configuration in search head cluster environment.

I have created kvstore with lookup editor app from a search head instance. Now, I would like to add a new column. So, I have to modify from collections.conf right?. However, the configuration is not on SHC but search head instances. What is the best way to add a new column of kvstore?

Thank you

[gcusello]

Hi @karn ,

you could add a columns to a lookup using the Lookup Editor app, but remember to modify also the Lookup Definition.

With a csv lookup, you don't need to modify the Lookup Definition, but it's required for KV-Store lookups.

Ciao.

Giuseppe

[karn]

I can't see editing menu on lookup editor app , please guide me.

Karn

[PaulPanther · Accepted solution]

Have you tried to use the API to add the field?

KV store endpoint descriptions - Splunk Documentation

[karn]

it works.

curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/search/storage/collections/config/mykvstore -d "field.my_new_column=string"

Thanks