Getting Data In

How to add a CSV file to an existing kvstore?

prtrnr13
New Member

I am trying to add data to an existing kvstore. I have tried to input the data via a CSV. I'm new to Splunk and need assistance so any help is greatly appreciated. Thanks in advance.

0 Karma

starcher
Influencer

Load the csv as a normal lookup. Then look at doing an inputlookup of your csv followed by an outlook up to the kvstore lookup. Co sided append=true on the outputlookup if you don't want to wipe out existing data. Talking to your splunk admin would be a good idea on the steps involved if you are new.

0 Karma

starcher
Influencer

If you are more a developer you can modify a copy of this as a method to push csv content to a collection. https://github.com/georgestarcher/Splunk-ESIntel-KVStore/blob/master/splunk-es-threat-intel.py

0 Karma

prtrnr13
New Member

Thanks - I'll give it a shot.

0 Karma
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...