Getting Data In

How to update a kvstore field from a local CSV file?

edroche3rd
Explorer

Happy Sunday All!

I added a field to my KVSTORE, but want to be able to backfill that field with the appropriate data. I don't have access to the server to put input file on server then input. Is there a way to do it from a CSV from my desktop?

Thanks
Ed

0 Karma

n00badmin
Communicator

You could make an API call to manage the store..

http://dev.splunk.com/view/webframework-features/SP-CAAAEZG

or use | outputlookup my_kvstore

from search results (if ur data is avail there), where my_kvstore is the name of your store, to overwrite that kvstore entry...
be sure you look up the key first so you update/delete the right record!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...