Splunk Search

How to assign field name as primary key in kvstore lookup table

hemalalli
Explorer

I need to insert some records to lookup table and make sure that the lookup table should not allow the duplicate insertion
I'm using service.request POST REST call to insert the records to the collection via Splunk HTML view.

NOTE: I don't want to use "dedup" to display, because I need to avoid insert if the lookup table has another record.

Please help !

Tags (3)
0 Karma
1 Solution

hemalalli
Explorer

I have implemented the workaround to avoid duplication while inserting to the KV store collection

Once the fields are entered in the splunk view, I'm running the search query and getting the key(_key) if the fields are matching in the KV store collection, if the key is available then I'm popping up the messaging saying "Record already exist", otherwise I'm inserting the record.

Thanks and Regards,
Hema

View solution in original post

0 Karma

hemalalli
Explorer

I have implemented the workaround to avoid duplication while inserting to the KV store collection

Once the fields are entered in the splunk view, I'm running the search query and getting the key(_key) if the fields are matching in the KV store collection, if the key is available then I'm popping up the messaging saying "Record already exist", otherwise I'm inserting the record.

Thanks and Regards,
Hema

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...