Getting Data In

How to create or update KV Store via REST endpoints?

hypePG
Path Finder

Hello,

I want to fill my KVStore with information from a script. The script adds data via a REST Endpoint to the KVStore.

The key in the store is a hostname of a machine. The problem is, if I want to add a new host to the KVStore, but there is already an entry for this host, I will get an error. On the other hand, I can't use the "Update-method" because if it is a new host, I will get the an error as well.

I know that I could handle this problem in my script, but I wanted to know if there is a "clever" update function:

If there is a record in the KVStore then update the item, and if there isn't, create a new one.

thank you in advance.

0 Karma
1 Solution

Murali2888
Communicator

I don't think there is an update function to insert/update records in KV Store with that level of intelligence.

As you said, you can handle this by two way approach in your script using the respective REST End Points.

  1. Query the KV Store for the existence of the Key
  2. If present, use the storage/collections/data/{collection}/{id} end point to update the record
  3. else, use storage/collections/data/{collection}/ to insert a new record

Please refer the links for more details / examples
http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTkvstore
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTkvstoreExamples

View solution in original post

gyslainlatsa
Motivator
0 Karma

Murali2888
Communicator

I don't think there is an update function to insert/update records in KV Store with that level of intelligence.

As you said, you can handle this by two way approach in your script using the respective REST End Points.

  1. Query the KV Store for the existence of the Key
  2. If present, use the storage/collections/data/{collection}/{id} end point to update the record
  3. else, use storage/collections/data/{collection}/ to insert a new record

Please refer the links for more details / examples
http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTkvstore
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTkvstoreExamples

hypePG
Path Finder

Hello,

thank you for your answers. The batch_save operation is exactly doing this job.

thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...