Splunk Enterprise Security

KV Store - audit trail?

driekhof
Path Finder

We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store records need to be modified or deleted. We're thinking of adding a status field (Active, Inactive, Deleted) and always creating a new KV Store record when these things occur.

Any examples around of doing something like this with a KV Store? Is there a way to allow users to modify a custom status field but not modify any other part of the record and not delete a record?

Know of a better way to do this?

0 Karma

bthaker_splunk
Splunk Employee
Splunk Employee

Have you tried this: Use the REST API to manage KV Store collections and data:
https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/

0 Karma

starcher
Influencer

No there isn’t. Kvstore is a lookup table not a database. You can either read only or modify.

0 Karma

driekhof
Path Finder

I think it actually is a DB under the covers (Mongo).

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...