I finally got my head wrapped around kvstore and how I can benefit from it. I have a bunch of data to load into a kvstore, how do I bulk load it without having to have a curl command for each entry?
Best idea would be to save your data as a CSV file.
Do an inputlookup for that file and an outputlookup to your kvstore.
| inputlookup data.csv
| outputlookup kvstore
That way you can do any extra ETL either in the CSV file, or between the inputlookup and outputlookup stages
There is an app to help you with this, Lookup File Editor App for Splunk Enterprise:
Lookup File Editor App for Splunk Enterprise