There is option add a field to an existing kvstore without edit conf files?

[siv]

There is option add a field to an existing kvstore without edit conf files?

I dont own the server so it be It's difficult to get there all the time.

[livehybrid]

Hi @siv ,

Yes, you can add a field to an existing KV Store collection without directly editing collections.conf by using the Splunk REST API.

See https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/#... for more info, but will cover briefly below.

You can use curl to add a new field named new_field_name of type string to a collection named my_collection within the my_app app context. You'll need to update the existing field definitions and include the new one in the payload.

First, get the current definition (optional but helpful):

curl -k -u admin:yourpassword \
https://<serverName>:8089/servicesNS/nobody/my_app/storage/collections/config/my_collection

Then, POST the updated configuration, including all existing fields plus the new one:

curl -k -u admin:yourpassword \
     -X POST \
     https://<serverName>:8089/servicesNS/nobody/my_app/storage/collections/config/my_collection \
     -d 'field.existing_field1=string' \
     -d 'field.existing_field2=number' \
     -d 'field.new_field_name=string' # Add your new field here

This method requires appropriate permissions, specifically the POST / Updating capability, to modify KV Store configurations via the REST API. Using the REST API effectively updates the configuration as if you had edited the collections.conf file, but does so remotely.

Documentation:

• KV Store REST API Endpoints: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTkvstore
• Specifically, the collection endpoint: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTkvstore#storage.2Fcollections.2Fconf...

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gcusello]

Hi @siv ,

I don't think so, you could try to upload a file with the additional column, but I'm not sure.

ciao.

Giuseppe