Getting Data In

How to add a CSV file to an existing kvstore?

prtrnr13
New Member

I am trying to add data to an existing kvstore. I have tried to input the data via a CSV. I'm new to Splunk and need assistance so any help is greatly appreciated. Thanks in advance.

0 Karma

starcher
Influencer

Load the csv as a normal lookup. Then look at doing an inputlookup of your csv followed by an outlook up to the kvstore lookup. Co sided append=true on the outputlookup if you don't want to wipe out existing data. Talking to your splunk admin would be a good idea on the steps involved if you are new.

0 Karma

starcher
Influencer

If you are more a developer you can modify a copy of this as a method to push csv content to a collection. https://github.com/georgestarcher/Splunk-ESIntel-KVStore/blob/master/splunk-es-threat-intel.py

0 Karma

prtrnr13
New Member

Thanks - I'll give it a shot.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...