I'm currently retrieving lookups from another SH in this way:
| rest splunk_server=server_name splunk_server_group=* /services/search/jobs/export
search=" | inputlookup my_lookup.csv" output_mode=csv
This produces 2 columns, splunk_server and value
The problem I'm facing is when I'm trying to do the same with a kvstore I'm not getting anything in the field value. Is it any way to retrieve the kvstore information in the same way?
Thanks in advance.
Or borrow from the original code:
Hi, thanks for the info! Could you provide a query in Splunk for this? Thanks in advance.