You could look it up. First you have to create a lookup stanza in transforms.conf :
externaltype = kvstore
collection = COLLECTIONNAME
fieldslist = _key, COMMASEPARATEDFIELDLISTOFYOURKVSTORE
| inputlookup COLLECTIONNAME_lookup
Hope that works in free license.
Well - I tried it and got the following errors:
Error in 'inputlookup' command: The lookup table 'Requires license feature=KVStore' is invalid.
Looking at the splunkd.log I find the following lines:
INFO LMTracker - Setting feature=KVStore state=ENABLED (featureStatus=1)
a few lines later.....
INFO LMTracker - Setting feature=KVStore state=DISABLEDDUETO_LICENSE (featureStatus=2)
I guess that this is saying that KV Store is not valid in the Free License?
This is a known issue in Splunk Enterprise 6.2 (SPL-92740). KV store should be available under the free license. This defect will be fixed in a forthcoming maintenance release.