Knowledge Management

Splunk SDK for Python: What is the best way to update a KV Store and add potential records if there is no key match?

goodsellt
Contributor

Hello!

I'm looking into using the Python SDK's KV store module to do some updating of a KV store. I've noticed that the insert & update functions are separate, leading me to asking this: How should I best go about updating a KV store and adding any potential records if there is no key match? Does the 'update' function create a new record if a key does not match, or would it return some kind of ValueError or something similar I can do a try/except loop for?

Also are there any examples or guides out there for this functionality (apart from the reference manual which I've found)? I'd just like to see it in action so I can verify some other questions I had, such as should my "data" document string be the same JSON as I would put in the REST POST method?

Thanks!

0 Karma
1 Solution

goodsellt
Contributor

Old answer incorrect, here is corrected version:

If the record/key does not appear when you do a .data.update, the REST endpoint will return a HTTP 404 -- Object not found error.

What I've done to solve this problem is catch that exception inside of my python script, and then have an alternative version of the object send (with the _key in the document instead of an argument to the call) using .data.insert.

You're also able to use .data.batch_save with a properly parsed list of json documents which invalidates the need for the above.

View solution in original post

0 Karma

goodsellt
Contributor

Old answer incorrect, here is corrected version:

If the record/key does not appear when you do a .data.update, the REST endpoint will return a HTTP 404 -- Object not found error.

What I've done to solve this problem is catch that exception inside of my python script, and then have an alternative version of the object send (with the _key in the document instead of an argument to the call) using .data.insert.

You're also able to use .data.batch_save with a properly parsed list of json documents which invalidates the need for the above.

0 Karma

goodsellt
Contributor

I've found the update function will automatically upsert as long as I'm passing a key to it.

0 Karma

goodsellt
Contributor

This answer is incorrect. My testing was not valid.

0 Karma

organus
Explorer

This wouldn't work for me.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...