How to create a KVStore using Python SDK w/ SPL commands?

[yurippe]

Hello,
I am trying to create a kvstore that I can use in a | inputlookup and / or | lookup SPL command. I can create a KVStore using the python SDK, but it can not be used with the above commands.
(I have tried many things and variations in the create command, but this is what I assume to be the most correct:)

>>> splunk.kvstore.create(name="testkvstore", **{"sharing": "global"})
{'status': 201, ...}
>>> splunk.kvstore["testkvstore"].data.app
'system'
>>> splunk.kvstore["testkvstore"].data.sharing
'system'
>>> splunk.kvstore["testkvstore"].data.owner
'nobody'

>>> splunk.kvstore["testkvstore"].data.insert(json.dumps({"_key": "test", "value": "result"}))
{'_key': 'test'}

Yet I cannot find it with inputlookup nor lookup. This does not work in splunk cloud nor local instance

[starcher · Accepted solution]

Did you create a transforms stanza to reference the kvstore collection?

[yurippe]

No, any tips on how I would do this via the RESP API ?

[yurippe]

I figured it out, thank you very much
Here is enough code to be able to figure it out for anyone else who might stumble upon this:

kv = splunk.kvstore
kv.create(name="kvtestcollection", fields={"_key": "string", "name": "string"}, owner="nobody", sharing="system")
kv["kvtestcollection"].data.insert(json.dumps({"_key": "hello", "name": "world"}))
#kv["kvtestcollection"].delete()
transforms = splunk.confs["transforms"]
transforms.create(name="kvtestcollection_lookup", **{"external_type": "kvstore", "collection": "kvtestcollection", "fields_list": "_key, name", "owner": "nobody"})
#transforms["kvtestcollection_lookup"].delete()