Up till now, I am using csv file lookup. An input runs every day, and updates this CSV file. This must happen in order to keep the inputlookup up to date. But that is not so user friendly when it comes to SHC deployment scenario.
I am planning to switch to KV store collection, but I have a major unknown area: How can I periodically update this KV store collection form TA input? If there is any way for this, how will it work in SHC scenario?
Please have a look at the sample app for start : http://dev.splunk.com/view/SP-CAAAEZT
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEY7
http://dev.splunk.com/view/SP-CAAAEZG