Hi @siv , Yes, you can add a field to an existing KV Store collection without directly editing collections.conf by using the Splunk REST API. See https://dev.splunk.com/enterprise/docs/developapps/...
See more...
Hi @siv , Yes, you can add a field to an existing KV Store collection without directly editing collections.conf by using the Splunk REST API. See https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/#:~:text=Define%20the%20collection%20schema%3A for more info, but will cover briefly below. You can use curl to add a new field named new_field_name of type string to a collection named my_collection within the my_app app context. You'll need to update the existing field definitions and include the new one in the payload. First, get the current definition (optional but helpful): curl -k -u admin:yourpassword \
https://<serverName>:8089/servicesNS/nobody/my_app/storage/collections/config/my_collection Then, POST the updated configuration, including all existing fields plus the new one: curl -k -u admin:yourpassword \
-X POST \
https://<serverName>:8089/servicesNS/nobody/my_app/storage/collections/config/my_collection \
-d 'field.existing_field1=string' \
-d 'field.existing_field2=number' \
-d 'field.new_field_name=string' # Add your new field here This method requires appropriate permissions, specifically the POST / Updating capability, to modify KV Store configurations via the REST API. Using the REST API effectively updates the configuration as if you had edited the collections.conf file, but does so remotely. Documentation: KV Store REST API Endpoints: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTkvstore Specifically, the collection endpoint: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTkvstore#storage.2Fcollections.2Fconfig.2F.7Bcollection.7D Did this answer help you? If so, please consider: Adding kudos to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing