Splunk Cloud
We have lookup data that needs to be accessed from Splunk Cloud. This data can either come from an external source, e.g. from curl requests to an external API (a), or from a lookup in Splunk (b)
For (a), this would require curl outbound access - the webtools add on is not Cloud certified and I am not sure if it would be possible to upload this type of command extension
For (b) it means getting a static file daily/weekly to a place where it can be pushed into Splunk.
- The REST API for KV store is not supported in Cloud
So, I was thinking of ingesting the data to an index and then having a saved search that writes to the KV store after each upload. That's a bit of a pain as the upload would count to ingestion quotas and it just seems the wrong way to do it.
Anyone done this before, or got a better solution?
