TrackMe: How to add sourcetypes programatically to... - Splunk Community

Monitoring Splunk

I would like the results of a search to populate the allow/block lists in TrackeMe. The lookup file requires a unique key.

Any tips on how to generate that at search time?

Are you referring to _key?
That's autogenerated for kvstore entries. You don't need to manually generate it

-
Alerts for Splunk Admins, Version Control for Splunk, Decrypt2 VersionControl For SplunkCloud

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...