Knowledge Management
Highlighted

How do I bulk load a kvstore without having to have a curl command for each entry?

Builder

I finally got my head wrapped around kvstore and how I can benefit from it. I have a bunch of data to load into a kvstore, how do I bulk load it without having to have a curl command for each entry?

0 Karma
Highlighted

Re: How do I bulk load a kvstore without having to have a curl command for each entry?

Communicator

Best idea would be to save your data as a CSV file.

Do an inputlookup for that file and an outputlookup to your kvstore.


| inputlookup data.csv
| outputlookup kvstore

That way you can do any extra ETL either in the CSV file, or between the inputlookup and outputlookup stages

Highlighted

Re: How do I bulk load a kvstore without having to have a curl command for each entry?

Esteemed Legend

There is an app to help you with this, Lookup File Editor App for Splunk Enterprise:

https://splunkbase.splunk.com/app/1724/

0 Karma