It seems using KV store from migrating from lookups seems to be very easy. Just outputlookup to a KV store stanza. But Is there an easy way to update a record, instead of just bulk reloading of a lookup table. For example, I would like to update a field for a record in KV store from the results from a Splunk search.
Please take a look on http://dev.splunk.com/view/SP-CAAAEZH
By default, each KV Store record has a
unique key ID, which is stored in the
internal "_key" field. When you use
outputlookup to write to the KV Store,
a key ID is autogenerated if you don't
specify one explicitly. If you want to
modify a specific record, you need to
provide its key ID.
So to do what you want you need: a) know _key field b) use append=True c) have the whole record (not just one field), because outputlookup with append=true will replace existing document with specified _key.