Splunk Search

How to create a KV store that pulls events from an indexer?

naqviah
Explorer

Hi,

I am trying to create a KV Store that pulls events from an indexer. It should display the Event, Log Line, Domain, and IP. Additionally, it should have a comment box and name of the person who is adding the comment pulled from the user account making the change. The comment box should also have an audit trail since numerous users are able to input a comment for an event.

Can someone help me with this? How should i approach it? Any documentation that will allow me to do this?

Thanks

0 Karma

dperre_splunk
Splunk Employee
Splunk Employee

Links with details below but kvstores can be appended just like lookup tables. So you just need to create a search like something below

your search | table event,longline,domain,ip | outputlookup yourkvstorename append=true

Really awesome write up on kvstores here.

http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZK

Similar question here
https://answers.splunk.com/answers/227766/is-there-an-easy-way-to-update-a-record-in-kv-stor.html

And a link to how you can append a kvstore.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Outputlookup

naqviah
Explorer

I am still unable to add a COMMENT TEXT BOX for each event in the table. Also, I need to add a checkbox in front of each event. Please HELP!

0 Karma

dperre_splunk
Splunk Employee
Splunk Employee

This sounds like you are trying to make something like the investigator timeline from Enterprise Security.

Also what you are trying to achieve is not what KV Stores are traditionally used for. Have a look at the Splunk Java SDK. With the java sdk you can write your own dashboards and as it's JS you have a lot of flexibility with the scripting language.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...