Hello Splunkers, Could you please help me design a solution for the below use case .
Usecase:I have one CSV file which contains Service center locations and has fields Name,Address,Status,Rating. Now I want , if user updates any field in this file it should reflect in KV store lookup file .
What I tried: I have created KV store lookup for KV store CRUD .In dashboard, I have created one form which contains all these input fields, where user can perform CRUD operations for KV store lookup file. Everything is working properly but I am not able to update the CSV file. Is there anyway to update CSV file also when we update KV store lookup?
Please help me to find the solution of this usecase.
You could of course reverse the process (which i think is your last question) but you should be careful about about situations where there are deltas in both.
I'm not totally clear from your question if this is likely, but if so, you will want to expand the process to load both sets of data, perform any deduplication and establish which of the files contents takes precedence before writing your output.
Thanks @nickhillscpl for your reply,Here CSV file is not a lookup file. The CSV file is stored at C:\Program Files\Splunk\etc\apps\myApp\bin and I want to know ,if I update this file(CSV) the same needs to be reflected in KV store lookup also or If I update KV store lookup the same thing also updated in CSV file.
Must it be in that path?
If you moved the file to $SPLUNK_HOME/etc/apps/yourapp/lookups you could make it a lookup file and do as I mentioned above (both read & write to/from it)
If you have to leave it in another path, you could configure a file monitor on that path and index it.
That way changes to it would get ingested, and you could table the results and write it to the KV Store, but you would not be able to write changes back into it.