Getting Data In

How to add a CSV file to an existing kvstore?

New Member

I am trying to add data to an existing kvstore. I have tried to input the data via a CSV. I'm new to Splunk and need assistance so any help is greatly appreciated. Thanks in advance.

0 Karma

SplunkTrust
SplunkTrust

Load the csv as a normal lookup. Then look at doing an inputlookup of your csv followed by an outlook up to the kvstore lookup. Co sided append=true on the outputlookup if you don't want to wipe out existing data. Talking to your splunk admin would be a good idea on the steps involved if you are new.

0 Karma

SplunkTrust
SplunkTrust

If you are more a developer you can modify a copy of this as a method to push csv content to a collection. https://github.com/georgestarcher/Splunk-ESIntel-KVStore/blob/master/splunk-es-threat-intel.py

0 Karma

New Member

Thanks - I'll give it a shot.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!