How to switch the CMDB lookups in splunk to the KV store ?

[srampally]

We currently have lookups and want to move to KV store. What and how can we do that

[lekanneer]

If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/

I created that solution and continuously adding new features. One of the use cases I have done is comparing data available in Splunk with what is in CMDB.

[woodcock]

Are you using ES or your own custom search environment?

[srampally]

we are using ES

[woodcock]

So far as I know, this is not supported. What is prompting your move to KV Store? Are you in SHC? If so, then a move to KV Store is suicide anyway.