Splunk Enterprise Security

KV Store - audit trail?

driekhof
Path Finder

We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store records need to be modified or deleted. We're thinking of adding a status field (Active, Inactive, Deleted) and always creating a new KV Store record when these things occur.

Any examples around of doing something like this with a KV Store? Is there a way to allow users to modify a custom status field but not modify any other part of the record and not delete a record?

Know of a better way to do this?

0 Karma

bthaker_splunk
Splunk Employee
Splunk Employee

Have you tried this: Use the REST API to manage KV Store collections and data:
https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/

0 Karma

starcher
Influencer

No there isn’t. Kvstore is a lookup table not a database. You can either read only or modify.

0 Karma

driekhof
Path Finder

I think it actually is a DB under the covers (Mongo).

Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...